Loading

interop.techweb.com DORK REPORT SUMMARY

Netsparker - DORK Report Summary
TARGET URL
https://interop.reg.techweb.com/lasvegas/2011...
DORK DATE
4/14/2011 1:39:05 PM
REPORT DATE
4/14/2011 1:57:11 PM
DORK DURATION
00:07:03

Total Requests

Average Speed

req/sec.
7
identified
4
confirmed
0
critical
1
informational

GHDB, DORK Tests

GHDB, DORK Tests
PROFILE
Previous Settings
ENABLED ENGINES
Blind SQL Injection, Boolean SQL Injection, SQL Injection, Cross-site Scripting
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security DORKner
IMPORTANT
29 %
LOW
57 %
INFORMATION
14 %
Cross-site Scripting

Cross-site Scripting

1 TOTAL
IMPORTANT
CONFIRMED
1
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.

XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.

Impact

There are many different attacks that can be leveraged through the use of XSS, including:

Remedy

The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.

Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.

There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.

Remedy References

External References

- /lasvegas/2011/login/index

/lasvegas/2011/login/index CONFIRMED

https://interop.reg.techweb.com/lasvegas/2011/login/index

Parameters

Parameter Type Value
request POST 42de1ccd9de849fd8d57a7274f300784
redirect POST ' stYle=x:expre/**/ssion(alert(9)) ns='
user POST 3
password POST 3
rememberMe POST 1

Request

POST /lasvegas/2011/login/index HTTP/1.1
Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: interop.reg.techweb.com
Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=6727g2o8ij8e1e24h33nv9p2v6; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000
Content-Length: 136
Accept-Encoding: gzip, deflate

request=42de1ccd9de849fd8d57a7274f300784&redirect='+stYle%3dx%3aexpre%2f**%2fssion(netsparker(9))+ns%3d'+&user=3&password=3&rememberMe=1

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:44:20 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 5435
Content-Type: text/html; charset=UTF-8
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/rememberLoginEmail.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/index";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_index"><div class="IP_Messages"><div class="message error">The following error(s) occurred:<br /><ul><li><label for="request">The two given tokens do not match</label></li></ul></div></div><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/index" method="post"><div class="ip-container"><div class="ip-element"><label for="request" class="ip-elementLabel required ip-elementLabel errorFieldLabel">Request Token<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="1b0a16ccd0aed4d5488384f9557929ee" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="' stYle=x:expre/**/ssion(netsparker(9)) ns='" id="redirect" /></span></div><div class="ip-element"><label for="user" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="user" id="user" value="3" class="ip-formText" /></span></div><div class="ip-element"><label for="password" class="ip-elementLabel required ip-elementLabel">Password<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="password" name="password" id="password" value="" class="ip-formPassword" /><p class="description"><br clear="left"/><a href = /lasvegas/2011/login/forgotpassword/redirect/' stYle=x:expre/**/ssion(netsparker(9)) ns='> Forgot Password? </a></p></span></div><div class="ip-element"><label for="rememberMe" class="ip-elementLabel optional ip-elementLabel">Remember e-mail login<span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="hidden" name="rememberMe" value="0" /><input type="checkbox" name="rememberMe" id="rememberMe" value="1" checked="checked" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Login</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
Cookie Not Marked As Secure

Cookie Not Marked As Secure

1 TOTAL
IMPORTANT
CONFIRMED
1
A Cookie was not marked as secure and transmitted over HTTPS. This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic or following a successful MITM (Man in the middle) attack.

Impact

This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (such as a session cookie) an attacker might intercept it and hijack a victim's session. If the attacker can carry out a MITM attack, he/she can force victim to make a HTTP request to steal the cookie.

Actions to Take

  1. See the remedy for solution.
  2. Mark all cookies used within the application as secure. (If the cookie is not related to authentication or does not carry any personal information you do not have to mark it as secure.))

Remedy

Mark all cookies used within the application as secure.

Required Skills for Successful Exploitation

To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or victim's network. Attackers need to be understand layer 2, have physical access to systems either as way points for the traffic, or locally (have gained access to) to a system between the victim and the web server.
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations

/lasvegas/2011/login/forgotpassword/controllerName/Registrations CONFIRMED

https://interop.reg.techweb.com/lasvegas/2011/login/forgotpassword/controllerName/Registrations

Identified Cookie

BNI__BARRACUDA_LB_COOKIE

Request

GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1
Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: interop.reg.techweb.com
Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:38:56 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3958
Content-Type: text/html; charset=UTF-8
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
Auto Complete Enabled

Auto Complete Enabled

1 TOTAL
LOW
CONFIRMED
1
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".

Impact

Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.

Remedy

Add the attribute autocomplete="off" to the form tag or to individual "input" fields.

Actions to Take

  1. See the remedy for the solution.
  2. Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
  3. Re-DORK the application after addressing the identified issues to ensure that all of the fixes have been applied properly.

Required Skills for Successful Exploitation

Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.

External References

- /lasvegas/2011/Registrations

/lasvegas/2011/Registrations CONFIRMED

https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.130279087..

Identified Field Name

password

Request

GET /lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: interop.reg.techweb.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:38:55 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Set-Cookie: 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; path=/; secure,BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=1, max=82
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/rememberLoginEmail.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script><script type="text/javascript">//<![CDATA[$(document).ready(function() { jQuery("input[name=\"vhLeJi62\"]").uniqueEmail({"controllerUrl":"\/lasvegas\/2011\/index\/Registrations\/","verifiedEmail":null}); IP.Filter.bindContainer(jQuery("div[pagebuilder_layout]"));IP.Filter.checkAllTargets();});IP.Filter.addTarget("ipgMpQ45" ,"[unique_id=eAXWJA96]" ,"and"); IP.Filter.addTarget("tMzsxY25" ,"[unique_id=lyNnYd98]" ,"and"); IP.Filter.addTarget("sxrmIo68" ,"[unique_id=vhLeJi62]" ,"and"); IP.Filter.addTarget("EMDUDc49" ,"[unique_id=fvuhSN21]" ,"and"); IP.Filter.addTarget("qGAdiD25" ,"[unique_id=QeHtCy13]" ,"and"); IP.Filter.addTarget("heqKgM69" ,"[unique_id=ptDVXt43]" ,"and"); IP.Filter.addTarget("HWgABU98" ,"[unique_id=EQSUfR75]" ,"and"); IP.Filter.addTarget("AyVIbg10" ,"[unique_id=ObPCNq17]" ,"and"); IP.Filter.addTarget("rnjyZQ36" ,"[unique_id=THqFxi51]" ,"and"); IP.Filter.addTarget("EcCGiM68" ,"[unique_id=jypvpK68]" ,"and"); IP.Filter.addTarget("JwrbJo50" ,"[unique_id=mKAKqW38]" ,"and");//]]></script> </head><body id="public" class="index_registrations_index"><script>
_udn = "none";
_uhash = "off";
</script><!-- Google Website Optimizer Control Script --><script>
function utmx_section(){}function utmx(){}
(function(){var k='0700847492',d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash;
d.write('<sc'+'ript src="'+
'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com'
+'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime='
+new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+
'" type="text/javascript" charset="utf-8"></sc'+'ript>')})();
</script><!-- End of Google Website Optimizer Control Script --><script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-1310215-9']);
_gaq.push(['_setDomainName','none']);
_gaq.push(['_setAllowLinker',true]);
_gaq.push(['_setAllowHash',false]);
if ( typeof(utmx) != 'undefined' && utmx('combination') != undefined) {
_gaq.push(['_setCustomVar',1,'gwo-lv-variation',utmx('combination'),2]);
}
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
</script>
<p><style media="screen, projection, print" type="text/css">

* { font-family: 'Segoe UI', Arial, Verdana, sans-serif !important; } /* Defeat default CSS from https://web.ubm.aetherquest.com/assets/scripts/IP.css */

.force-clear { clear: both; }

.packageName { font-weight: bold; }
.packageDescription { font-style: italic; padding-bottom: 15px; }
input.IE7_Radio { margin: 3px 6px 0px 0px; } /* some spacing for the radio buttons on Packages */

*:first-child+html #public.index_registrations_profile .IE7_Radio,
*:first-child+html #public.index_registrations_demographics .IE7_Radio,
*:first-child+html #public.index_registrations_housing .IE7_Radio,
*:first-child+html #public.index_registrations_review .IE7_Radio,
*:first-child+html #public.index_registrations_payment .IE7_Radio,
*:first-child+html #public.index_registrations_packages .IE7_Radio,
*:first-child+html #public.index_registrations_hotel .IE7_Radio
{
width: 50px !important;
}

td.packageRadio { *text-align: right !important; }

div.ip-button a { background-color: #666666; text-decoration: none; }
div.ip-button a:hover { background-color: #666666; text-decoration: underline; }
div.ip-button.ip-button-submit a { background-color: #1568AE; }
div.ip-button.ip-button-submit a:hover { background-color: #357EC2; }
div.ip-button.ip-button-cancel a { background-color: #B6B3AB; }
div.ip-button.ip-button-cancel a:hover { background-color: #B6B3AB; }

/* Begin progress bar */
#centeredmenu {
background-color: #cccccc;
border: 1px solid #666666;
clear: both;
float: left;
font-size: .9em;
*padding-bottom: 5px !important;
-moz-border-radius: 10px; -webkit-border-radius: 10px; -khtml-border-radius: 10px; border-radius: 10px;
overflow-x: visible;
overflow-y: visible;
position: relative;
width: auto;
}
#centeredmenu ul { left: 0%; margin: 0px !important; padding: 0px !important; }
#centeredmenu ul li {
display: block;
float: left;
list-style-type: none;
list-style-image: none;
list-style-position: outside;
margin: 0px !important;
padding: 0px !important;
position: relative;
right: 0%;
}
ul#progress li, ul#progress li span { float: left; list-style-type: none; }
ul#progress span { color: #666666; }
ul#progress li span { padding: 6px 0px 0px 19px !important; }
ul#progress li.currentStep {
background-color: white !important;
-moz-border-radius: 5px; -webkit-border-radius: 5px; -khtml-border-radius: 5px; border-radius: 5px;
}
ul#progress li.currentStep span { border: none; *margin-bottom: 5px; }
ul#progress li { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px 7px; margin: 5px !important; padding: 5px !important; }
ul#progress li#step2 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -27px; }
ul#progress li#step3 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -61px; }
ul#progress li#step4 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -94px; }
ul#progress li#step5 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -128px; }
ul#progress li#step6 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -161px; }
ul#progress li#step7 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -193px; }
ul#progress li#step8 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -226px; }
ul#progress li#step9 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -259px; }
/* End progress bar */



.disclaimer { clear: left; color: #666666; font-size: .9em; line-height: 1.1em; margin-bottom: 10px; padding-left: 10px; }
.disclaimer a { text-decoration: none; }
.disclaimer a:hover {text-decoration: underline; }

/* End EV2-specific CSS - begin the theme... */



html, body, #header, #headerContent, #mainMenu, #mainMenu ul, #columnOne, #columnTwo, #columnThree, #advertisements { margin: 0px; padding: 0px; }
body { background-color: white; color: #292929; font-family: Helvetica, Arial, Verdana, sans-serif; font-size: .9em; }

a, a:visited { color: #296490; }
a:hover, a:active { color: #427A9B; text-decoration: none; }

h1, h2, h3 { color: #292929; font-family: Helvetica, Arial, sans-serif; font-weight: bold; }
h1, h2 { letter-spacing: -0.05em; }
h3 { letter-spacing: -0.04em; }
hr { border: 1px solid #999999; margin: 0px !important; padding: 0px !important; }
iframe { margin: 0px 0px 0px 12px; }
sup { font-size: .7em; }

#breadCrumb { font-size: 80%; margin: 10px 0px 6px 0px; }
#breadCrumb a { color: #444444 !important; text-decoration: none; }
#breadCrumb a:hover { color: #666666 !important; text-decoration: underline; }

img.landscape { border: 1px solid #cccccc; float: right; margin-bottom: 3px; margin-left: 3px; padding: 3px; width: 200px; }

.backToTop { text-align: right; }
.centered { margin: auto; padding: 0px; text-align: center; }
.clear { clear: both; margin: 0px; padding: 0px; }
.more { text-align: right; }
.noTopMargin { margin-top: 0px !important; padding-top: 0px !important; }
.noBottomMargin { margin-bottom: 0px !important; padding-bottom: 0px !important; }
.small { font-size: .8em; }


/*
HEADER
**********************************************************
*/
#wrapper { margin: 0px auto; min-height: inherit; padding: 20px 0px 0px 0px; }
#headerContent, #headerMessage, #mainMenu, #wrapper { width: 999px; }

#header { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-splash.jpg') no-repeat bottom center; height: 168px; }
#header, #headerContent { margin: 0px auto; }
#headerContent { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-bg.png') repeat-x top left; color: white; font-family: Helvetica, Arial, sans-serif; font-size: 1.2em; height: 49px; letter-spacing: 2px; padding: 13px 21px 0px 47px; text-transform: uppercase; vertical-align: middle; width: 931px; }
#headerContent #logo { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-logo.png') no-repeat top right; margin-top: -4px; *margin-top: -23px; float: right; }
#headerContent #logo, #headerContent #logo img { height: 29px; width: 183px; }
#headerContent #logo img { /*border: 1px solid red;*/ display: block; margin: 0px; } /* The floating transparent image overlaid on the logo. Links to homepage. */

#headerMessage { background-color: #faf4d0; border-bottom: 2px solid black; display: none; font-size: 20px; height: 32px; margin: 0px auto; padding-top: 5px; text-align: center; vertical-align: middle; }
#headerMessage a { color: #FF0000; }





/*
MAIN MENU
**********************************************************
*/
#mainMenu { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/nav-bg.png') repeat-x top left; display: block; height: 37px; margin: 0px auto; }
/*** ESSENTIAL STYLES - menu uses suckerfish, see header for Javascript includes needed (jquery.js, hoverIntent.js, superfish.js) ***/
.sf-menu, .sf-menu * { list-style: none; margin: 0; padding: 0; }
.sf-menu { line-height: 1.0; }
.sf-menu ul { position: absolute; top: -999em; width: 15em; /* left offset of submenus need to match (see below) */ }
.sf-menu ul li { width: 100%; }
.sf-menu li:hover { visibility: inherit; /* fixes IE7 'sticky bug' */ }
.sf-menu li { float: left; position: relative; }
.sf-menu a { display: block; position: relative; }
.sf-menu li:hover ul, .sf-menu li.sfHover ul { left: 0; top: 3.08em; /* match top ul list item height */ z-index: 99; }
ul.sf-menu li:hover li ul, ul.sf-menu li.sfHover li ul { top: -999em; }
ul.sf-menu li li:hover ul, ul.sf-menu li li.sfHover ul { left: 15em;/* match ul width */ top: 0; }
ul.sf-menu li li:hover li ul, ul.sf-menu li li.sfHover li ul { top: -999em; }
ul.sf-menu li li li:hover ul, ul.sf-menu li li li.sfHover ul { left: 15em;/* match ul width */ top: 0; }

/*** SKIN ***/
.sf-menu { float: left; font-size: .8em; margin-bottom: 1em; *z-index: 99999 !important; }
.sf-menu a { border-left: 1px solid #C1C1C1; padding: 1em .75em; text-decoration: none; }
.sf-menu li:first-child a { border-left: none; } /* first top level link gets no border */
.sf-menu a, .sf-menu a:visited { /* visited pseudo selector so IE6 applies text colour*/ color: #292929; font-weight: bold; }
.sf-menu a:hover { color: #464646; text-decoration: none; } /* Hover styles for top level links */
.sf-menu li { /*background: #671940;*/ }
.sf-menu li ul {
opacity: 0.95; /* CSS3 */
-moz-opacity: 0.95; /* Firefox */
filter: alpha(opacity=95); /* IE6 */
}
.sf-menu li li { background: #E4E4E4; border-bottom: 1px solid white; } /* Base colors for sub-menu items */
.sf-menu li li:first-child a { border-left: 1px solid #C1C1C1; } /* Re-establish left borders for first links in child ULs */
.sf-menu li li a, .sf-menu li li a:visited { /*color: #671940;*/ }
.sf-menu li li li { }
.sf-menu li:hover, .sf-menu li.sfHover, .sf-menu a:focus, .sf-menu a:hover, .sf-menu a:active { background-color: #E4E4E4; outline: 0; } /* Hover color for top level items */
.sf-menu li li a, .sf-menu li li a:visited { color: /*#016559*/#296490; } /* Color for sub-items */
.sf-menu li li a:hover, .sf-menu li:hover li:hover { background-color: #EEEEEE; color: /*#292929*/#427A9B; } /* Hover colors for sub-items */
/*** arrows **/
.sf-menu a.sf-with-ul { padding-right: 1.9em; min-width: 1px; /* trigger IE7 hasLayout so spans position accurately */ }
.sf-sub-indicator {
position: absolute;
display: block;
right: .75em;
top: 1.17em; /* IE6 only */
width: 10px;
height: 10px;
text-indent: -999em;
overflow: hidden;
background: url('/eventAssets/intero_lasvegas_2011_100908200353/arrows-2e2d2d.png') no-repeat -10px -100px; /* 8-bit indexed alpha png. IE6 gets solid image only */
}
a > .sf-sub-indicator { /* give all except IE6 the correct values */ top: 1.1em; background-position: 0 -100px; /* use translucent arrow for modern browsers*/ }
/* apply hovers to modern browsers */
a:focus > .sf-sub-indicator, a:hover > .sf-sub-indicator,
a:active > .sf-sub-indicator, li:hover > a > .sf-sub-indicator,
li.sfHover > a > .sf-sub-indicator { background-position: -10px -100px; /* arrow hovers for modern browsers*/ }
/* point right for anchors in subs */
.sf-menu ul .sf-sub-indicator { background-position: -10px 0; }
.sf-menu ul a > .sf-sub-indicator { background-position: 0 0; }
/* apply hovers to modern browsers */
.sf-menu ul a:focus > .sf-sub-indicator, .sf-menu ul a:hover > .sf-sub-indicator,
.sf-menu ul a:active > .sf-sub-indicator, .sf-menu ul li:hover > a > .sf-sub-indicator,
.sf-menu ul li.sfHover > a > .sf-sub-indicator { background-position: -10px 0; /* arrow hovers for modern browsers*/ }



/*
COLUMN ONE 111111111111111111111111111
**********************************************************
*/
#columnOne { background-color: #E9E9E9; border-right: 1px solid #f0f2f4; float: left; font-size: .9em; width: 174px; padd..
Cookie Not Marked As HttpOnly

Cookie Not Marked As HttpOnly

1 TOTAL
LOW
CONFIRMED
1
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

  1. See the remedy for solution
  2. Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

- /lasvegas/2011/login/forgotpassword/controllerName/Registrations

/lasvegas/2011/login/forgotpassword/controllerName/Registrations CONFIRMED

https://interop.reg.techweb.com/lasvegas/2011/login/forgotpassword/controllerName/Registrations

Identified Cookie

BNI__BARRACUDA_LB_COOKIE

Request

GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1
Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: interop.reg.techweb.com
Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:38:56 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3958
Content-Type: text/html; charset=UTF-8
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
Apache Version Disclosure

Apache Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is an Apache server. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.

Impact

An attacker can search for specific security vulnerabilities for the version of Apache identified within the SERVER header.

Remedy

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations

/lasvegas/2011/login/forgotpassword/controllerName/Registrations

https://interop.reg.techweb.com/lasvegas/2011/login/forgotpassword/controllerName/Registrations

Extracted Version

Apache/2.2.3 (Red Hat)

Request

GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1
Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: interop.reg.techweb.com
Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:38:56 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3958
Content-Type: text/html; charset=UTF-8
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
PHP Version Disclosure

PHP Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.

Impact

An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations

/lasvegas/2011/login/forgotpassword/controllerName/Registrations

https://interop.reg.techweb.com/lasvegas/2011/login/forgotpassword/controllerName/Registrations

Extracted Version

PHP/5.2.9

Request

GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1
Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: interop.reg.techweb.com
Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:38:56 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3958
Content-Type: text/html; charset=UTF-8
Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1>&nbsp;<span class="requiredSymbolClass">&bull;</span></span><span class="requiredSymbol">&nbsp;<span class="notRequiredSymbolClass">&bull;</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
E-mail Address Disclosure

E-mail Address Disclosure

1 TOTAL
INFORMATION
Netsparker found e-mail addresses on the web site.

Impact

E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .

Remedy

Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.

External References

- /lasvegas/2011/Registrations

/lasvegas/2011/Registrations

https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.130279087..

Found E-mails

Request

GET /lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: interop.reg.techweb.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 14 Apr 2011 18:38:55 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.2.9
Set-Cookie: 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; path=/; secure,BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=1, max=82
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/rememberLoginEmail.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = "&nbsp;<span class=\"requiredSymbolClass\">&bull;<\/span>";IP.requiredSymbolPlaceHolder = "&nbsp;<span class=\"notRequiredSymbolClass\">&bull;<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script><script type="text/javascript">//<![CDATA[$(document).ready(function() { jQuery("input[name=\"vhLeJi62\"]").uniqueEmail({"controllerUrl":"\/lasvegas\/2011\/index\/Registrations\/","verifiedEmail":null}); IP.Filter.bindContainer(jQuery("div[pagebuilder_layout]"));IP.Filter.checkAllTargets();});IP.Filter.addTarget("ipgMpQ45" ,"[unique_id=eAXWJA96]" ,"and"); IP.Filter.addTarget("tMzsxY25" ,"[unique_id=lyNnYd98]" ,"and"); IP.Filter.addTarget("sxrmIo68" ,"[unique_id=vhLeJi62]" ,"and"); IP.Filter.addTarget("EMDUDc49" ,"[unique_id=fvuhSN21]" ,"and"); IP.Filter.addTarget("qGAdiD25" ,"[unique_id=QeHtCy13]" ,"and"); IP.Filter.addTarget("heqKgM69" ,"[unique_id=ptDVXt43]" ,"and"); IP.Filter.addTarget("HWgABU98" ,"[unique_id=EQSUfR75]" ,"and"); IP.Filter.addTarget("AyVIbg10" ,"[unique_id=ObPCNq17]" ,"and"); IP.Filter.addTarget("rnjyZQ36" ,"[unique_id=THqFxi51]" ,"and"); IP.Filter.addTarget("EcCGiM68" ,"[unique_id=jypvpK68]" ,"and"); IP.Filter.addTarget("JwrbJo50" ,"[unique_id=mKAKqW38]" ,"and");//]]></script> </head><body id="public" class="index_registrations_index"><script>
_udn = "none";
_uhash = "off";
</script><!-- Google Website Optimizer Control Script --><script>
function utmx_section(){}function utmx(){}
(function(){var k='0700847492',d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash;
d.write('<sc'+'ript src="'+
'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com'
+'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime='
+new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+
'" type="text/javascript" charset="utf-8"></sc'+'ript>')})();
</script><!-- End of Google Website Optimizer Control Script --><script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-1310215-9']);
_gaq.push(['_setDomainName','none']);
_gaq.push(['_setAllowLinker',true]);
_gaq.push(['_setAllowHash',false]);
if ( typeof(utmx) != 'undefined' && utmx('combination') != undefined) {
_gaq.push(['_setCustomVar',1,'gwo-lv-variation',utmx('combination'),2]);
}
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
</script>
<p><style media="screen, projection, print" type="text/css">

* { font-family: 'Segoe UI', Arial, Verdana, sans-serif !important; } /* Defeat default CSS from https://web.ubm.aetherquest.com/assets/scripts/IP.css */

.force-clear { clear: both; }

.packageName { font-weight: bold; }
.packageDescription { font-style: italic; padding-bottom: 15px; }
input.IE7_Radio { margin: 3px 6px 0px 0px; } /* some spacing for the radio buttons on Packages */

*:first-child+html #public.index_registrations_profile .IE7_Radio,
*:first-child+html #public.index_registrations_demographics .IE7_Radio,
*:first-child+html #public.index_registrations_housing .IE7_Radio,
*:first-child+html #public.index_registrations_review .IE7_Radio,
*:first-child+html #public.index_registrations_payment .IE7_Radio,
*:first-child+html #public.index_registrations_packages .IE7_Radio,
*:first-child+html #public.index_registrations_hotel .IE7_Radio
{
width: 50px !important;
}

td.packageRadio { *text-align: right !important; }

div.ip-button a { background-color: #666666; text-decoration: none; }
div.ip-button a:hover { background-color: #666666; text-decoration: underline; }
div.ip-button.ip-button-submit a { background-color: #1568AE; }
div.ip-button.ip-button-submit a:hover { background-color: #357EC2; }
div.ip-button.ip-button-cancel a { background-color: #B6B3AB; }
div.ip-button.ip-button-cancel a:hover { background-color: #B6B3AB; }

/* Begin progress bar */
#centeredmenu {
background-color: #cccccc;
border: 1px solid #666666;
clear: both;
float: left;
font-size: .9em;
*padding-bottom: 5px !important;
-moz-border-radius: 10px; -webkit-border-radius: 10px; -khtml-border-radius: 10px; border-radius: 10px;
overflow-x: visible;
overflow-y: visible;
position: relative;
width: auto;
}
#centeredmenu ul { left: 0%; margin: 0px !important; padding: 0px !important; }
#centeredmenu ul li {
display: block;
float: left;
list-style-type: none;
list-style-image: none;
list-style-position: outside;
margin: 0px !important;
padding: 0px !important;
position: relative;
right: 0%;
}
ul#progress li, ul#progress li span { float: left; list-style-type: none; }
ul#progress span { color: #666666; }
ul#progress li span { padding: 6px 0px 0px 19px !important; }
ul#progress li.currentStep {
background-color: white !important;
-moz-border-radius: 5px; -webkit-border-radius: 5px; -khtml-border-radius: 5px; border-radius: 5px;
}
ul#progress li.currentStep span { border: none; *margin-bottom: 5px; }
ul#progress li { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px 7px; margin: 5px !important; padding: 5px !important; }
ul#progress li#step2 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -27px; }
ul#progress li#step3 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -61px; }
ul#progress li#step4 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -94px; }
ul#progress li#step5 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -128px; }
ul#progress li#step6 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -161px; }
ul#progress li#step7 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -193px; }
ul#progress li#step8 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -226px; }
ul#progress li#step9 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -259px; }
/* End progress bar */



.disclaimer { clear: left; color: #666666; font-size: .9em; line-height: 1.1em; margin-bottom: 10px; padding-left: 10px; }
.disclaimer a { text-decoration: none; }
.disclaimer a:hover {text-decoration: underline; }

/* End EV2-specific CSS - begin the theme... */



html, body, #header, #headerContent, #mainMenu, #mainMenu ul, #columnOne, #columnTwo, #columnThree, #advertisements { margin: 0px; padding: 0px; }
body { background-color: white; color: #292929; font-family: Helvetica, Arial, Verdana, sans-serif; font-size: .9em; }

a, a:visited { color: #296490; }
a:hover, a:active { color: #427A9B; text-decoration: none; }

h1, h2, h3 { color: #292929; font-family: Helvetica, Arial, sans-serif; font-weight: bold; }
h1, h2 { letter-spacing: -0.05em; }
h3 { letter-spacing: -0.04em; }
hr { border: 1px solid #999999; margin: 0px !important; padding: 0px !important; }
iframe { margin: 0px 0px 0px 12px; }
sup { font-size: .7em; }

#breadCrumb { font-size: 80%; margin: 10px 0px 6px 0px; }
#breadCrumb a { color: #444444 !important; text-decoration: none; }
#breadCrumb a:hover { color: #666666 !important; text-decoration: underline; }

img.landscape { border: 1px solid #cccccc; float: right; margin-bottom: 3px; margin-left: 3px; padding: 3px; width: 200px; }

.backToTop { text-align: right; }
.centered { margin: auto; padding: 0px; text-align: center; }
.clear { clear: both; margin: 0px; padding: 0px; }
.more { text-align: right; }
.noTopMargin { margin-top: 0px !important; padding-top: 0px !important; }
.noBottomMargin { margin-bottom: 0px !important; padding-bottom: 0px !important; }
.small { font-size: .8em; }


/*
HEADER
**********************************************************
*/
#wrapper { margin: 0px auto; min-height: inherit; padding: 20px 0px 0px 0px; }
#headerContent, #headerMessage, #mainMenu, #wrapper { width: 999px; }

#header { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-splash.jpg') no-repeat bottom center; height: 168px; }
#header, #headerContent { margin: 0px auto; }
#headerContent { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-bg.png') repeat-x top left; color: white; font-family: Helvetica, Arial, sans-serif; font-size: 1.2em; height: 49px; letter-spacing: 2px; padding: 13px 21px 0px 47px; text-transform: uppercase; vertical-align: middle; width: 931px; }
#headerContent #logo { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-logo.png') no-repeat top right; margin-top: -4px; *margin-top: -23px; float: right; }
#headerContent #logo, #headerContent #logo img { height: 29px; width: 183px; }
#headerContent #logo img { /*border: 1px solid red;*/ display: block; margin: 0px; } /* The floating transparent image overlaid on the logo. Links to homepage. */

#headerMessage { background-color: #faf4d0; border-bottom: 2px solid black; display: none; font-size: 20px; height: 32px; margin: 0px auto; padding-top: 5px; text-align: center; vertical-align: middle; }
#headerMessage a { color: #FF0000; }





/*
MAIN MENU
**********************************************************
*/
#mainMenu { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/nav-bg.png') repeat-x top left; display: block; height: 37px; margin: 0px auto; }
/*** ESSENTIAL STYLES - menu uses suckerfish, see header for Javascript includes needed (jquery.js, hoverIntent.js, superfish.js) ***/
.sf-menu, .sf-menu * { list-style: none; margin: 0; padding: 0; }
.sf-menu { line-height: 1.0; }
.sf-menu ul { position: absolute; top: -999em; width: 15em; /* left offset of submenus need to match (see below) */ }
.sf-menu ul li { width: 100%; }
.sf-menu li:hover { visibility: inherit; /* fixes IE7 'sticky bug' */ }
.sf-menu li { float: left; position: relative; }
.sf-menu a { display: block; position: relative; }
.sf-menu li:hover ul, .sf-menu li.sfHover ul { left: 0; top: 3.08em; /* match top ul list item height */ z-index: 99; }
ul.sf-menu li:hover li ul, ul.sf-menu li.sfHover li ul { top: -999em; }
ul.sf-menu li li:hover ul, ul.sf-menu li li.sfHover ul { left: 15em;/* match ul width */ top: 0; }
ul.sf-menu li li:hover li ul, ul.sf-menu li li.sfHover li ul { top: -999em; }
ul.sf-menu li li li:hover ul, ul.sf-menu li li li.sfHover ul { left: 15em;/* match ul width */ top: 0; }

/*** SKIN ***/
.sf-menu { float: left; font-size: .8em; margin-bottom: 1em; *z-index: 99999 !important; }
.sf-menu a { border-left: 1px solid #C1C1C1; padding: 1em .75em; text-decoration: none; }
.sf-menu li:first-child a { border-left: none; } /* first top level link gets no border */
.sf-menu a, .sf-menu a:visited { /* visited pseudo selector so IE6 applies text colour*/ color: #292929; font-weight: bold; }
.sf-menu a:hover { color: #464646; text-decoration: none; } /* Hover styles for top level links */
.sf-menu li { /*background: #671940;*/ }
.sf-menu li ul {
opacity: 0.95; /* CSS3 */
-moz-opacity: 0.95; /* Firefox */
filter: alpha(opacity=95); /* IE6 */
}
.sf-menu li li { background: #E4E4E4; border-bottom: 1px solid white; } /* Base colors for sub-menu items */
.sf-menu li li:first-child a { border-left: 1px solid #C1C1C1; } /* Re-establish left borders for first links in child ULs */
.sf-menu li li a, .sf-menu li li a:visited { /*color: #671940;*/ }
.sf-menu li li li { }
.sf-menu li:hover, .sf-menu li.sfHover, .sf-menu a:focus, .sf-menu a:hover, .sf-menu a:active { background-color: #E4E4E4; outline: 0; } /* Hover color for top level items */
.sf-menu li li a, .sf-menu li li a:visited { color: /*#016559*/#296490; } /* Color for sub-items */
.sf-menu li li a:hover, .sf-menu li:hover li:hover { background-color: #EEEEEE; color: /*#292929*/#427A9B; } /* Hover colors for sub-items */
/*** arrows **/
.sf-menu a.sf-with-ul { padding-right: 1.9em; min-width: 1px; /* trigger IE7 hasLayout so spans position accurately */ }
.sf-sub-indicator {
position: absolute;
display: block;
right: .75em;
top: 1.17em; /* IE6 only */
width: 10px;
height: 10px;
text-indent: -999em;
overflow: hidden;
background: url('/eventAssets/intero_lasvegas_2011_100908200353/arrows-2e2d2d.png') no-repeat -10px -100px; /* 8-bit indexed alpha png. IE6 gets solid image only */
}
a > .sf-sub-indicator { /* give all except IE6 the correct values */ top: 1.1em; background-position: 0 -100px; /* use translucent arrow for modern browsers*/ }
/* apply hovers to modern browsers */
a:focus > .sf-sub-indicator, a:hover > .sf-sub-indicator,
a:active > .sf-sub-indicator, li:hover > a > .sf-sub-indicator,
li.sfHover > a > .sf-sub-indicator { background-position: -10px -100px; /* arrow hovers for modern browsers*/ }
/* point right for anchors in subs */
.sf-menu ul .sf-sub-indicator { background-position: -10px 0; }
.sf-menu ul a > .sf-sub-indicator { background-position: 0 0; }
/* apply hovers to modern browsers */
.sf-menu ul a:focus > .sf-sub-indicator, .sf-menu ul a:hover > .sf-sub-indicator,
.sf-menu ul a:active > .sf-sub-indicator, .sf-menu ul li:hover > a > .sf-sub-indicator,
.sf-menu ul li.sfHover > a > .sf-sub-indicator { background-position: -10px 0; /* arrow hovers for modern browsers*/ }



/*
COLUMN ONE 111111111111111111111111111
**********************************************************
*/
#columnOne { background-color: #E9E9E9; border-right: 1px solid #f0f2f4; float: left; font-size: .9em; width: 174px; padd..