Jump to content

Test My Email Analysis Site

T Horton

By T Horton
in Beta Test Your Stuff!

 Share

Recommended Posts

T Horton Newbie

T Horton

Posted
Posted

Hello All

 

I was just wondering whether there are some willing volunteers who would be able to test my beta version of some email analysis software I have written in PHP for me?

 

The host address is: www.detect.thehortonfamily.co.uk

 

Any comments, suggestions, bugs, criticisms etc would be most appreciated.

 

Also a better name for it would be great too  ;D

 

Thanks all and look forward to receiving your comments very soon.

 

Best Regards

 

 

 

Tom Horton

Link to comment
Share on other sites
Lumio Member

Lumio

Posted
Posted

500 Internal Server Error

 

My header:

Return-Path: <burtondd@vividdvd.com>
Delivered-To: falk@citrosaft.com
Received: by citrosaft.com (Postfix, from userid 5000)
id 6BDFE63004F; Tue, 13 May 2008 11:35:18 +0200 (CEST)
Received: from localhost by zitronenkuh.athome
with SpamAssassin (version 3.1.7-deb);
Tue, 13 May 2008 11:35:18 +0200
From: Soft bestellen hier <burtondd@vividdvd.com>
To: falk@citrosaft.com
Subject: Entdecken Sie die Quelle fuer den Billigkauf
Date: Tue, 13 May 2008 14:57:47 +0530
Message-Id: <263388928.79487900940718@vividdvd.com>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05) on 
zitronenkuh.athome
X-Spam-Level: XXXXXXXX
X-Spam-Status: Yes, score=8.3 required=3.0 tests=BAYES_99,HTML_40_50,
HTML_MESSAGE,HTML_TITLE_EMPTY,URIBL_JP_SURBL autolearn=no 
version=3.1.7-deb
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_482960D6.210E88AD"

Link to comment
Share on other sites
T Horton Newbie

T Horton

Posted
  • Author
Posted

Hi "Lumio"

 

Thanks for that.

 

I know what the problem is. On the last line of your header, you will see there is a ";" half way across. For some reason the server doesn't like that, thus the 500 internal error. If you press the enter key straight after that, and put the remaining text on a new line, you should find it will work (it did for me when I tried it).

 

I am currently investigating a workaround for this so that end users don't need to be aware of it.

 

Looking at your header, it would appear there is no IP address to help the Detect software track down where it has come from exactly, but what I aim to do is incorporate a domain name lookup as well as the IP lookup, so that if there is no IP address, there is at least one point of contact to start with.

 

Thanks again for testing it. I will keep you posted on the progress.

 

Best Regards

 

 

 

 

Tom

 

Link to comment
Share on other sites
T Horton Newbie

T Horton

Posted
  • Author
Posted

Hi "Lumio"

 

Just to let you know I have now finally fixed that bug you told me about.

 

If you try that header you sent me, you should find that works now. You should also find the layout and features slightly different to the first time you tested too. Hopefully for the better.

 

If you come across any other bugs, or if you have any other ideas for the software then please do let me know.

 

Many thanks for your help on this.

 

Best Regards

 

 

 

 

Tom

Link to comment
Share on other sites
  • 1 month later...
darkfreaks Advanced Member

darkfreaks

Posted
Posted

XSS Vunerability:

The GET variable ip has been set to <script>alert(396460229916)</script>.

 

XSS Vunerability:

The GET variable ip has been set to </textarea><ScRiPt%20%0a%0d>alert(396500229918)%3B</ScRiPt>.

XSS Vunerability:

The GET variable ip has been set to email@some<ScRiPt%20%0a%0d>alert(396530229918)%3B</ScRiPt>domain.com.

XSS Vunerability:

The GET variable ip has been set to </title><ScRiPt%20%0a%0d>alert(396510229918)%3B</ScRiPt>.

XSS Vunerability:

<ScRiPt+src=http://testphp.acunetix.com/xss.js?396650230073></ScRiPt>.

XSS Vunerability:

The GET variable ip has been set to <body+onload=alert(396640230073)>.

XSS Vunerability:

The GET variable ip has been set to <script/xss+src=http://testphp.acunetix.com/xss.js?396660230203></script>

XSS Vunerability:

<img+src=http://testphp.acunetix.com/dot.gif+onload=alert(396670230203)>.

XSS Vunerability:

The GET variable ip has been set to %3C/xss/*-*/style=xss:e/**/xpression(alert(396830230327))%3E.

XSS Vunerability:

The GET variable ip has been set to <iframe/+/onload=alert(396860230436)></iframe>.

Link to comment
Share on other sites
darkfreaks Advanced Member

darkfreaks

Posted
Posted

 

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /webfxlayout.js.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /webfxlayout.js HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 404 Not Found

Date: Wed, 09 Jul 2008 03:42:08 GMT

Server: NOYB

Connection: close

Content-Type: text/html; charset=iso-8859-1 View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

Remove the links to this file or make this available.

 

Broken links

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /webfxapi.js.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /webfxapi.js HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 404 Not Found

Date: Wed, 09 Jul 2008 03:42:08 GMT

Server: NOYB

Connection: close

Content-Type: text/html; charset=iso-8859-1 View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

Remove the links to this file or make this available.

 

Broken links

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /inc/monofont.ttf.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

 

How to fix this vulnerability

Remove the links to this file or make this available.

 

Broken links

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /local/dhtml/xmenu/xmenu.css.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /local/dhtml/xmenu/xmenu.css HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk/local/webfxlayout.css

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 404 Not Found

Date: Wed, 09 Jul 2008 03:42:37 GMT

Server: NOYB

Connection: close

Content-Type: text/html; charset=iso-8859-1 View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

Remove the links to this file or make this available.

 

Broken links

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /inc/index.php.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /inc/index.php HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk/inc/header.php

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 404 Not Found

Date: Wed, 09 Jul 2008 03:42:39 GMT

Server: NOYB

Connection: close

Content-Type: text/html; charset=iso-8859-1 View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

Remove the links to this file or make this available.

 

Broken links

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /inc/scanemail.php.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /inc/scanemail.php HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk/inc/header.php

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 404 Not Found

Date: Wed, 09 Jul 2008 03:42:39 GMT

Server: NOYB

Connection: close

Content-Type: text/html; charset=iso-8859-1 View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

Remove the links to this file or make this available.

 

Broken links

Vulnerability description

This page was found as link but is inaccessible.

This vulnerability affects /inc/contactus.php.

The impact of this vulnerability

Problems navigating the site.

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /inc/contactus.php HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk/inc/header.php

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 404 Not Found

Date: Wed, 09 Jul 2008 03:42:39 GMT

Server: NOYB

Connection: close

Content-Type: text/html; charset=iso-8859-1 View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

Remove the links to this file or make this available

 

Vulnerability description

Password type input named password from unnamed form with action login.php has autocomplete enabled. An attacker with local access could obtain the cleartext password from the browser cache.

This vulnerability affects /.

The impact of this vulnerability

Possible sensitive information disclosure

 

Attack details

No details are available.

 

View HTTP headers

Request

GET / HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Connection: Close

Pragma: no-cache

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 200 OK

Date: Wed, 09 Jul 2008 03:41:50 GMT

Server: NOYB

X-Powered-By: PHP/5.2.4

Set-Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Connection: close

Content-Type: text/html View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

The password autocomplete should be disabled in sensitive applications.

To disable autocomplete, you may use a code similar to:

<INPUT TYPE="password" AUTOCOMPLETE="off">

Password type input with autocomplete enabled

Vulnerability description

Password type input named password from unnamed form with action login.php has autocomplete enabled. An attacker with local access could obtain the cleartext password from the browser cache.

This vulnerability affects /index.php.

The impact of this vulnerability

Possible sensitive information disclosure

 

Attack details

No details are available.

 

View HTTP headers

Request

GET /index.php HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: www.detect.thehortonfamily.co.uk

Cookie: PHPSESSID=dfu8cb51ebv054c8mo8cukp3b0

Connection: Close

Pragma: no-cache

Referer: http://www.detect.thehortonfamily.co.uk

Acunetix-Product: WVS/5.0 (Acunetix Web Vulnerability Scanner - EVALUATION)

Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED

Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htmResponse

HTTP/1.1 200 OK

Date: Wed, 09 Jul 2008 03:42:08 GMT

Server: NOYB

X-Powered-By: PHP/5.2.4

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Connection: close

Content-Type: text/html View HTML response

Launch the attack with HTTP Editor

How to fix this vulnerability

The password autocomplete should be disabled in sensitive applications.

To disable autocomplete, you may use a code similar to:

<INPUT TYPE="password" AUTOCOMPLETE="off">

 

 

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.