arachni 0.4.0.4 → 0.4.1

data/spec/arachni/utilities_spec.rb

@@ -0,0 +1,297 @@
+# encoding: utf-8
+require_relative '../spec_helper'
+
+describe Arachni::Utilities do
+
+    before( :all ) do
+        @opts = Arachni::Options.instance
+        @utils = Arachni::Module::Utilities
+    end
+
+    describe '#uri_parser' do
+        it 'should return a URI::Parser' do
+            @utils.uri_parser.class.should == ::URI::Parser
+        end
+    end
+
+    describe '#uri_parse' do
+        it 'should parse a URI' do
+
+            scheme   = 'http'
+            user     = 'user'
+            password = 'password'
+            host     = 'subdomain.domainname.tld'
+            path     = '/some/path'
+            query    = 'param=val&param2=val2'
+
+            uri = "#{scheme}://#{user}:#{password}@#{host}#{path}?#{query}"
+
+            parsed_uri = @utils.uri_parse( uri )
+
+            parsed_uri.to_s.should == uri
+
+            parsed_uri.scheme.should == scheme
+            parsed_uri.user.should == user
+            parsed_uri.password.should == password
+            parsed_uri.host.should == host
+            parsed_uri.path.should == path
+            parsed_uri.query.should == query
+        end
+    end
+
+    describe '#uri_decode' do
+        it 'should decode a URI' do
+            uri = 'my%20test.asp?name=st%C3%A5le&car=saab'
+            @utils.uri_decode( uri ).should == "my test.asp?name=ståle&car=saab"
+        end
+    end
+
+    describe '#to_absolute' do
+        it 'should convert a relative path to absolute' do
+            @opts.url  = 'http://test2.com/blah/ha'
+            rel  = '/test'
+            rel2 = 'test2'
+            @utils.to_absolute( rel ).should == "http://test2.com" + rel
+            @utils.to_absolute( rel2 ).should == "http://test2.com/blah/" + rel2
+        end
+
+        context 'when called with a 2nd parameter' do
+            it 'should use it as a reference for the conversion' do
+                abs  = 'http://test.com/blah/ha'
+                rel  = '/test'
+                rel2 = 'test2'
+                @utils.to_absolute( rel, abs ).should == "http://test.com" + rel
+                @utils.to_absolute( rel2, abs ).should == "http://test.com/blah/" + rel2
+                @utils.to_absolute( rel2, abs + '/' ).should == "http://test.com/blah/ha/" + rel2
+            end
+        end
+    end
+
+    describe '#path_in_domain?' do
+        before { @opts.url = 'http://bar.com' }
+
+        context 'when a second argument (reference URL) is provided' do
+            context 'with a path that is in the domain' do
+                it 'should return true' do
+                    @utils.path_in_domain?( 'http://yes.com/foo', 'http://yes.com' ).should be_true
+                end
+            end
+            context 'with a path that is outside the domain' do
+                it 'should return true' do
+                    @utils.path_in_domain?( 'http://no.com/foo', 'http://yes.com' ).should be_false
+                end
+            end
+        end
+
+        context 'when follow subdomains is disabled' do
+            before { @opts.follow_subdomains = false }
+
+            context 'with a URL with a different domain' do
+                it 'should return false' do
+                    @utils.path_in_domain?( 'http://google.com' ).should be_false
+                    @utils.skip_path?( 'http://google.com' ).should be_true
+                end
+            end
+
+            context 'with a URL with the same domain' do
+                it 'should return true' do
+                    @utils.path_in_domain?( 'http://bar.com/test/' ).should be_true
+                    @utils.skip_path?( 'http://bar.com/test/' ).should be_false
+                end
+            end
+
+
+            context 'with a URL with a different subdomain' do
+                it 'should return false' do
+                    @utils.path_in_domain?( 'http://test.bar.com/test' ).should be_false
+                    @utils.skip_path?( 'http://test.bar.com/test' ).should be_true
+                end
+            end
+        end
+
+        context 'when follow subdomains is disabled' do
+            before { @opts.follow_subdomains = true }
+
+            context 'with a URL with a different domain' do
+                it 'should return false' do
+                    @utils.path_in_domain?( 'http://google.com' ).should be_false
+                    @utils.skip_path?( 'http://google.com' ).should be_true
+                end
+            end
+
+            context 'with a URL with the same domain' do
+                it 'should return true' do
+                    @utils.path_in_domain?( 'http://bar.com/test/' ).should be_true
+                    @utils.skip_path?( 'http://bar.com/test/' ).should be_false
+                end
+            end
+
+
+            context 'with a URL with a different subdomain' do
+                it 'should return true' do
+                    @utils.path_in_domain?( 'http://test.bar.com/test' ).should be_true
+                    @utils.skip_path?( 'http://test.bar.com/test' ).should be_false
+                end
+            end
+        end
+    end
+
+    describe '#exclude_path?' do
+        before { @opts.exclude << /skip_me/ }
+
+        context 'when a path matches an exclude rule' do
+            it 'should return true' do
+                @utils.exclude_path?( 'skip_me' ).should be_true
+                @utils.skip_path?( 'http://bar.com/skip_me' ).should be_true
+            end
+        end
+
+        context 'when a path does not match an exclude rule' do
+            it 'should return false' do
+                @utils.exclude_path?( 'not_me' ).should be_false
+                @utils.skip_path?( 'http://bar.com/not_me' ).should be_false
+            end
+        end
+    end
+
+    describe '#include_path?' do
+        before { @opts.include << /include_me/ }
+
+        context 'when a path matches an include rule' do
+            it 'should return true' do
+                @utils.include_path?( 'include_me' ).should be_true
+                @utils.skip_path?( 'http://bar.com/include_me' ).should be_false
+            end
+        end
+
+        context 'when a path does not match an include rule' do
+            it 'should return false' do
+                @utils.include_path?( 'not_me' ).should be_false
+                @utils.skip_path?( 'http://bar.com/not_me' ).should be_true
+            end
+        end
+    end
+
+
+    describe '#get_path' do
+        context 'when the url only has a path' do
+            it 'should not change it' do
+                uri_with_path = 'http://test.com/some/path/'
+                @utils.get_path( uri_with_path ).should == uri_with_path
+            end
+        end
+
+        context 'when the url only has a path without a terminating slash' do
+            it 'should append a slash to it' do
+                uri_with_path = 'http://test.com/some/path'
+                @utils.get_path( uri_with_path ).should == uri_with_path + '/'
+            end
+        end
+
+        context 'when the url has elements past its path' do
+            context 'with a slash after its path' do
+                it 'should only return it up to its path with a terminating slash' do
+                    uri = 'http://test.com/some/path/'
+                    uri2 = uri + '?query=val&var=val2#frag'
+                    @utils.get_path( uri2 ).should == uri
+                end
+            end
+
+            context 'with aout slash after its path' do
+                it 'should only return it up to its path with a terminating slash' do
+                    uri = 'http://test.com/some/path'
+                    uri2 = uri + '?query=val&var=val2#frag'
+                    @utils.get_path( uri2 ).should == uri + '/'
+                end
+            end
+        end
+    end
+
+    describe '#seed' do
+        it 'should return a random string' do
+            @utils.seed.class.should == String
+        end
+    end
+
+    describe '#normalize_url' do
+        it 'should clean the URL' do
+            ref = proc do |p|
+                n = Addressable::URI.parse( p ).normalize
+                n.path.gsub!( /\/+/, '/' )
+                n.fragment = nil
+                n.to_s
+            end
+
+            [
+                'another/path',
+                '/some/path',
+                'http://test.com',
+                'style.css',
+                'http://test.com/path/here',
+                'http://user@test.com/path/here',
+                'http://user:pass@test.com/path/here',
+                'http://user:pass@test.com:80/path/here',
+                'http://user:pass@test.com:81/path/here',
+                'http://user:pass@test.com:81/path/here?query=here&with=more vars',
+                'http://user:pass@test.com:81/path/here?query=here&with=more vars#and-fragment',
+                'http://localhost:4567',
+                'http://localhost:4567/',
+                'http://testfire.net/default.aspx',
+                'http://testfire.net/Privacypolicy.aspx?sec=Careers&template=US',
+                'http://testfire.net/disclaimer.htm?url=http://dd.d',
+                'hTTp://user:password@tEsT.com:81///with/////path/another weird '+
+                    'path %"&*[$)?query=crap&other=$54$5466][(\'"#fragment',
+                'http://test.com/login.php?goto?=domain.tld/index.php'
+            ].each { |p| @utils.normalize_url( p ).should == ref.call( p ) }
+        end
+    end
+
+    describe '#hash_keys_to_str' do
+        it 'should recursively convert a Hash\'s keys to strings' do
+            h1 = {
+                key1: 'val1',
+                hash: {
+                    lvl2: 'val2',
+                }
+            }
+
+            h2 = {
+                'key1' => 'val1',
+                'hash' => {
+                    'lvl2' => 'val2',
+                }
+            }
+
+            @utils.hash_keys_to_str( h1 ).should == h2
+        end
+    end
+
+    describe '#exception_jail' do
+        context 'when raise_exception = true' do
+            it 'should forward exceptions' do
+                begin
+                    @utils.exception_jail( true ) {
+                        raise 'Exception!'
+                    }
+                    false.should be_true
+                rescue RuntimeError => e
+                    true.should be_true
+                end
+            end
+        end
+
+        context 'when raise_exception = false' do
+            it 'should discard exceptions' do
+                begin
+                    @utils.exception_jail( false ) {
+                        raise 'Exception!'
+                    }
+                    true.should be_true
+                rescue RuntimeError => e
+                    false.should be_true
+                end
+            end
+        end
+    end
+
+end

data/spec/fixtures/auditstore.afr

@@ -0,0 +1,2959 @@
+--- !ruby/object:Arachni::AuditStore
+delta_time: "00:05:16"
+finish_datetime: Sun Jul 15 19:34:34 2012
+issues:
+- !ruby/object:Arachni::Issue
+  cvssv2: "9.0"
+  cwe: "79"
+  cwe_url: http://cwe.mitre.org/data/definitions/79.html
+  description: |-
+    Client-side code (like JavaScript) can
+        be injected into the web application which is then returned to the user's browser.
+        This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
+  elem: form
+  internal_modname: XSS
+  method: GET
+  mod_name: XSS
+  name: Cross-Site Scripting (XSS)
+  references:
+    ha.ckers: http://ha.ckers.org/xss.html
+    Secunia: http://secunia.com/advisories/9716/
+  remedy_guidance: |-
+    User inputs must be validated and filtered
+        before being returned as part of the HTML code of a page.
+  severity: High
+  tags:
+  - xss
+  - regexp
+  - injection
+  - script
+  url: http://testfire.net/search.aspx
+  var: txtSearch
+  variations:
+  - !ruby/object:Arachni::Issue
+    cvssv2: "9.0"
+    cwe: "79"
+    cwe_url: http://cwe.mitre.org/data/definitions/79.html
+    description: |-
+      Client-side code (like JavaScript) can
+          be injected into the web application which is then returned to the user's browser.
+          This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
+    elem: form
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 200 OK
+        Date: Sun, 15 Jul 2012 18:19:24 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: private
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 7303
+
+
+    id:
+    injected: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+    internal_modname: XSS
+    method: GET
+    mod_name: XSS
+    name: Cross-Site Scripting (XSS)
+    opts:
+      :redundant: false
+      :async: true
+      :elements:
+      - link
+      - form
+      - cookie
+      - header
+      - body
+      :train:
+      :format:
+      - 3
+      :flip_param: true
+      :injected_orig: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :altered: txtSearch
+      :element: form
+      :params:
+        txtSearch: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :follow_location: true
+      :injected: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :combo:
+        txtSearch: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :action: http://testfire.net/search.aspx
+      :match: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :regexp: ""
+    references:
+      ha.ckers: http://ha.ckers.org/xss.html
+      Secunia: http://secunia.com/advisories/9716/
+    regexp: ""
+    regexp_match: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+    remedy_guidance: |-
+      User inputs must be validated and filtered
+          before being returned as part of the HTML code of a page.
+    response:
+    severity: High
+    tags:
+    - xss
+    - regexp
+    - injection
+    - script
+    url: http://testfire.net/search.aspx
+    var: txtSearch
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cvssv2: "9.0"
+  cwe: "79"
+  cwe_url: http://cwe.mitre.org/data/definitions/79.html
+  description: |-
+    Client-side code (like JavaScript) can
+        be injected into the web application which is then returned to the user's browser.
+        This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
+  elem: link
+  internal_modname: XSS
+  method: GET
+  mod_name: XSS
+  name: Cross-Site Scripting (XSS)
+  references:
+    ha.ckers: http://ha.ckers.org/xss.html
+    Secunia: http://secunia.com/advisories/9716/
+  remedy_guidance: |-
+    User inputs must be validated and filtered
+        before being returned as part of the HTML code of a page.
+  severity: High
+  tags:
+  - xss
+  - regexp
+  - injection
+  - script
+  url: http://testfire.net/search.aspx
+  var: txtSearch
+  variations:
+  - !ruby/object:Arachni::Issue
+    cvssv2: "9.0"
+    cwe: "79"
+    cwe_url: http://cwe.mitre.org/data/definitions/79.html
+    description: |-
+      Client-side code (like JavaScript) can
+          be injected into the web application which is then returned to the user's browser.
+          This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
+    elem: link
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 200 OK
+        Date: Sun, 15 Jul 2012 18:19:40 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: private
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 7303
+
+
+    id:
+    injected: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+    internal_modname: XSS
+    method: GET
+    mod_name: XSS
+    name: Cross-Site Scripting (XSS)
+    opts:
+      :redundant: false
+      :async: true
+      :elements:
+      - link
+      - form
+      - cookie
+      - header
+      - body
+      :train:
+      :format:
+      - 3
+      :flip_param: true
+      :injected_orig: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :altered: txtSearch
+      :element: link
+      :params:
+        txtSearch: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :follow_location: true
+      :injected: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :combo:
+        txtSearch: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :action: http://testfire.net/search.aspx?txtSearch=
+      :match: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+      :regexp: ""
+    references:
+      ha.ckers: http://ha.ckers.org/xss.html
+      Secunia: http://secunia.com/advisories/9716/
+    regexp: ""
+    regexp_match: <some_dangerous_input_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed/>
+    remedy_guidance: |-
+      User inputs must be validated and filtered
+          before being returned as part of the HTML code of a page.
+    response:
+    severity: High
+    tags:
+    - xss
+    - regexp
+    - injection
+    - script
+    url: http://testfire.net/search.aspx
+    var: txtSearch
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cvssv2: "9.0"
+  cwe: "79"
+  cwe_url: http://cwe.mitre.org/data/definitions/79.html
+  description: |-
+    Unvalidated user input is being embedded in a HTML element.
+        This can lead to a Cross-Site Scripting vulnerability or a form of HTML manipulation.
+  elem: form
+  internal_modname: XSSHTMLTag
+  method: POST
+  mod_name: XSS in HTML tag
+  name: Cross-Site Scripting in HTML tag.
+  references:
+    ha.ckers: http://ha.ckers.org/xss.html
+    Secunia: http://secunia.com/advisories/9716/
+  remedy_guidance: |-
+    User inputs must be validated and filtered
+        before being returned as part of the HTML code of a page.
+  severity: High
+  tags:
+  - xss
+  - script
+  - tag
+  - regexp
+  - dom
+  - attribute
+  - injection
+  url: http://testfire.net/bank/login.aspx
+  var: uid
+  variations:
+  - !ruby/object:Arachni::Issue
+    cvssv2: "9.0"
+    cwe: "79"
+    cwe_url: http://cwe.mitre.org/data/definitions/79.html
+    description: |-
+      Unvalidated user input is being embedded in a HTML element.
+          This can lead to a Cross-Site Scripting vulnerability or a form of HTML manipulation.
+    elem: form
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 200 OK
+        Date: Sun, 15 Jul 2012 18:22:32 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: -1
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 8843
+
+
+    id:
+    injected: 1" arachni_xss_in_tag="9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed
+    internal_modname: XSSHTMLTag
+    method: POST
+    mod_name: XSS in HTML tag
+    name: Cross-Site Scripting in HTML tag.
+    opts:
+      :redundant: false
+      :async: true
+      :elements:
+      - link
+      - form
+      - cookie
+      - header
+      - body
+      :train:
+      :format:
+      - 2
+      :injected_orig: "\" arachni_xss_in_tag=\"9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed"
+      :altered: uid
+      :element: form
+      :params:
+        uid: 1" arachni_xss_in_tag="9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed
+        passw: 5543!%arachni_secret
+        btnSubmit: Login
+      :follow_location: true
+      :injected: 1" arachni_xss_in_tag="9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed
+      :combo:
+        uid: 1" arachni_xss_in_tag="9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed
+        passw: 5543!%arachni_secret
+        btnSubmit: Login
+      :action: http://testfire.net/bank/login.aspx
+      :match: "<input type=\"text\" id=\"uid\" name=\"uid\" value=\"1\" arachni_xss_in_tag=\"9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed\" style=\"width: 150px;\">"
+      :regexp: ""
+    references:
+      ha.ckers: http://ha.ckers.org/xss.html
+      Secunia: http://secunia.com/advisories/9716/
+    regexp: ""
+    regexp_match: "<input type=\"text\" id=\"uid\" name=\"uid\" value=\"1\" arachni_xss_in_tag=\"9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed\" style=\"width: 150px;\">"
+    remedy_guidance: |-
+      User inputs must be validated and filtered
+          before being returned as part of the HTML code of a page.
+    response:
+    severity: High
+    tags:
+    - xss
+    - script
+    - tag
+    - regexp
+    - dom
+    - attribute
+    - injection
+    url: http://testfire.net/bank/login.aspx
+    var: uid
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cvssv2: "9.0"
+  cwe: "89"
+  cwe_url: http://cwe.mitre.org/data/definitions/89.html
+  description: SQL code can be injected into the web application.
+  elem: form
+  internal_modname: SQLInjection
+  metasploitable: unix/webapp/arachni_sqlmap
+  method: POST
+  mod_name: SQLInjection
+  name: SQL Injection
+  references:
+    UnixWiz: http://unixwiz.net/techtips/sql-injection.html
+    Wikipedia: http://en.wikipedia.org/wiki/SQL_injection
+    SecuriTeam: http://www.securiteam.com/securityreviews/5DP0N1P76E.html
+    OWASP: http://www.owasp.org/index.php/SQL_Injection
+  remedy_code: ""
+  remedy_guidance: |-
+    User inputs must be validated and filtered
+        before being included in database queries.
+  severity: High
+  tags:
+  - sql
+  - injection
+  - regexp
+  - database
+  - error
+  url: http://testfire.net/bank/login.aspx
+  var: passw
+  variations:
+  - !ruby/object:Arachni::Issue
+    cvssv2: "9.0"
+    cwe: "89"
+    cwe_url: http://cwe.mitre.org/data/definitions/89.html
+    description: SQL code can be injected into the web application.
+    elem: form
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 500 Internal Server Error
+        Connection: close
+        Date: Sun, 15 Jul 2012 18:22:34 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: -1
+        Content-Type: text/html; charset=utf-8
+
+
+    id: System.Data.OleDb.OleDbException
+    injected: 5543!%arachni_secret'`--
+    internal_modname: SQLInjection
+    metasploitable: unix/webapp/arachni_sqlmap
+    method: POST
+    mod_name: SQLInjection
+    name: SQL Injection
+    opts:
+      :redundant: false
+      :async: true
+      :regexp: (?i-mx:System\.Data\.OleDb\.OleDbException)
+      :match: System.Data.OleDb.OleDbException
+      :substring:
+      :ignore:
+      - String or binary data would be truncated
+      :elements:
+      - link
+      - form
+      - cookie
+      - header
+      - body
+      :train:
+      :format:
+      - 2
+      :param_flip: true
+      :injected_orig: "'`--"
+      :altered: passw
+      :element: form
+      :params:
+        uid: "1"
+        passw: 5543!%arachni_secret'`--
+        btnSubmit: Login
+      :follow_location: true
+      :injected: 5543!%arachni_secret'`--
+      :combo:
+        uid: "1"
+        passw: 5543!%arachni_secret'`--
+        btnSubmit: Login
+      :action: http://testfire.net/bank/login.aspx
+      :verification: false
+      :id: System.Data.OleDb.OleDbException
+    references:
+      UnixWiz: http://unixwiz.net/techtips/sql-injection.html
+      Wikipedia: http://en.wikipedia.org/wiki/SQL_injection
+      SecuriTeam: http://www.securiteam.com/securityreviews/5DP0N1P76E.html
+      OWASP: http://www.owasp.org/index.php/SQL_Injection
+    regexp: (?i-mx:System\.Data\.OleDb\.OleDbException)
+    regexp_match: System.Data.OleDb.OleDbException
+    remedy_code: ""
+    remedy_guidance: |-
+      User inputs must be validated and filtered
+          before being included in database queries.
+    response:
+    severity: High
+    tags:
+    - sql
+    - injection
+    - regexp
+    - database
+    - error
+    url: http://testfire.net/bank/login.aspx
+    var: passw
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cvssv2: "9.0"
+  cwe: "89"
+  cwe_url: http://cwe.mitre.org/data/definitions/89.html
+  description: SQL code can be injected into the web application.
+  elem: form
+  internal_modname: SQLInjection
+  metasploitable: unix/webapp/arachni_sqlmap
+  method: POST
+  mod_name: SQLInjection
+  name: SQL Injection
+  references:
+    UnixWiz: http://unixwiz.net/techtips/sql-injection.html
+    Wikipedia: http://en.wikipedia.org/wiki/SQL_injection
+    SecuriTeam: http://www.securiteam.com/securityreviews/5DP0N1P76E.html
+    OWASP: http://www.owasp.org/index.php/SQL_Injection
+  remedy_code: ""
+  remedy_guidance: |-
+    User inputs must be validated and filtered
+        before being included in database queries.
+  severity: High
+  tags:
+  - sql
+  - injection
+  - regexp
+  - database
+  - error
+  url: http://testfire.net/bank/login.aspx
+  var: uid
+  variations:
+  - !ruby/object:Arachni::Issue
+    cvssv2: "9.0"
+    cwe: "89"
+    cwe_url: http://cwe.mitre.org/data/definitions/89.html
+    description: SQL code can be injected into the web application.
+    elem: form
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 500 Internal Server Error
+        Connection: close
+        Date: Sun, 15 Jul 2012 18:22:34 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: -1
+        Content-Type: text/html; charset=utf-8
+
+
+    id: System.Data.OleDb.OleDbException
+    injected: 1'`--
+    internal_modname: SQLInjection
+    metasploitable: unix/webapp/arachni_sqlmap
+    method: POST
+    mod_name: SQLInjection
+    name: SQL Injection
+    opts:
+      :redundant: false
+      :async: true
+      :regexp: (?i-mx:System\.Data\.OleDb\.OleDbException)
+      :match: System.Data.OleDb.OleDbException
+      :substring:
+      :ignore:
+      - String or binary data would be truncated
+      :elements:
+      - link
+      - form
+      - cookie
+      - header
+      - body
+      :train:
+      :format:
+      - 2
+      :param_flip: true
+      :injected_orig: "'`--"
+      :altered: uid
+      :element: form
+      :params:
+        uid: 1'`--
+        passw: 5543!%arachni_secret
+        btnSubmit: Login
+      :follow_location: true
+      :injected: 1'`--
+      :combo:
+        uid: 1'`--
+        passw: 5543!%arachni_secret
+        btnSubmit: Login
+      :action: http://testfire.net/bank/login.aspx
+      :verification: false
+      :id: System.Data.OleDb.OleDbException
+    references:
+      UnixWiz: http://unixwiz.net/techtips/sql-injection.html
+      Wikipedia: http://en.wikipedia.org/wiki/SQL_injection
+      SecuriTeam: http://www.securiteam.com/securityreviews/5DP0N1P76E.html
+      OWASP: http://www.owasp.org/index.php/SQL_Injection
+    regexp: (?i-mx:System\.Data\.OleDb\.OleDbException)
+    regexp_match: System.Data.OleDb.OleDbException
+    remedy_code: ""
+    remedy_guidance: |-
+      User inputs must be validated and filtered
+          before being included in database queries.
+    response:
+    severity: High
+    tags:
+    - sql
+    - injection
+    - regexp
+    - database
+    - error
+    url: http://testfire.net/bank/login.aspx
+    var: uid
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cvssv2: "4.3"
+  cwe: "22"
+  cwe_url: http://cwe.mitre.org/data/definitions/22.html
+  description: |-
+    The web application enforces improper limitation
+        of a pathname to a restricted directory.
+  elem: link
+  internal_modname: PathTraversal
+  metasploitable: unix/webapp/arachni_path_traversal
+  method: GET
+  mod_name: PathTraversal
+  name: Path Traversal
+  references:
+    OWASP: http://www.owasp.org/index.php/Path_Traversal
+    WASC: http://projects.webappsec.org/Path-Traversal
+  remedy_code: ""
+  remedy_guidance: |-
+    User inputs must be validated and filtered
+        before being used as a part of a filesystem path.
+  severity: Medium
+  tags:
+  - path
+  - traversal
+  - injection
+  - regexp
+  url: http://testfire.net/default.aspx
+  var: content
+  variations:
+  - !ruby/object:Arachni::Issue
+    cvssv2: "4.3"
+    cwe: "22"
+    cwe_url: http://cwe.mitre.org/data/definitions/22.html
+    description: |-
+      The web application enforces improper limitation
+          of a pathname to a restricted directory.
+    elem: link
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 200 OK
+        Date: Sun, 15 Jul 2012 18:19:02 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: -1
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 7207
+
+
+    id: "[\"\\ntimeout=30\\ndefault=multi(0)disk(0)rdisk(0)partition(1)\\\\WINDOWS\\n\"]"
+    injected: !binary |
+      Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4v
+      Li4vYm9vdC5pbmkALmh0bQ==
+
+    internal_modname: PathTraversal
+    metasploitable: unix/webapp/arachni_path_traversal
+    method: GET
+    mod_name: PathTraversal
+    name: Path Traversal
+    opts:
+      :redundant: false
+      :async: true
+      :regexp: (?mi-x:\[boot loader\](.*)\[operating systems\])
+      :match: "[\"\\ntimeout=30\\ndefault=multi(0)disk(0)rdisk(0)partition(1)\\\\WINDOWS\\n\"]"
+      :substring:
+      :ignore:
+      :elements:
+      - link
+      - form
+      - cookie
+      - header
+      - body
+      :train:
+      :format:
+      - 1
+      :injected_orig: !binary |
+        Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4v
+        Li4vYm9vdC5pbmkALmh0bQ==
+
+      :altered: content
+      :element: link
+      :params:
+        content: !binary |
+          Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4v
+          Li4vYm9vdC5pbmkALmh0bQ==
+
+      :follow_location: true
+      :injected: !binary |
+        Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4v
+        Li4vYm9vdC5pbmkALmh0bQ==
+
+      :combo:
+        content: !binary |
+          Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4v
+          Li4vYm9vdC5pbmkALmh0bQ==
+
+      :action: http://testfire.net/default.aspx?content=inside_contact.htm
+      :verification: false
+      :id: "[\"\\ntimeout=30\\ndefault=multi(0)disk(0)rdisk(0)partition(1)\\\\WINDOWS\\n\"]"
+    references:
+      OWASP: http://www.owasp.org/index.php/Path_Traversal
+      WASC: http://projects.webappsec.org/Path-Traversal
+    regexp: (?mi-x:\[boot loader\](.*)\[operating systems\])
+    regexp_match: "[\"\\ntimeout=30\\ndefault=multi(0)disk(0)rdisk(0)partition(1)\\\\WINDOWS\\n\"]"
+    remedy_code: ""
+    remedy_guidance: |-
+      User inputs must be validated and filtered
+          before being used as a part of a filesystem path.
+    response:
+    severity: Medium
+    tags:
+    - path
+    - traversal
+    - injection
+    - regexp
+    url: http://testfire.net/default.aspx
+    var: content
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "319"
+  cwe_url: http://cwe.mitre.org/data/definitions/319.html
+  description: Transmission of password does not use an encrypted channel.
+  elem: form
+  internal_modname: UnencryptedPasswordForms
+  method: GET
+  mod_name: UnencryptedPasswordForms
+  name: Unencrypted password form.
+  references:
+    OWASP Top 10 2010: http://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection
+  severity: Medium
+  tags:
+  - unencrypted
+  - password
+  - form
+  url: http://testfire.net/bank/login.aspx
+  var: passw
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "319"
+    cwe_url: http://cwe.mitre.org/data/definitions/319.html
+    description: Transmission of password does not use an encrypted channel.
+    elem: form
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:21:36 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "8664"
+    id:
+    injected:
+    internal_modname: UnencryptedPasswordForms
+    method: GET
+    mod_name: UnencryptedPasswordForms
+    name: Unencrypted password form.
+    opts:
+      :var: passw
+      :match: passw
+      :element: form
+      :regexp: ""
+    references:
+      OWASP Top 10 2010: http://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection
+    regexp: ""
+    regexp_match: passw
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual: Online Banking Login\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"../style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"keywords\" content=\"Altoro Mutual Login, login, authenticate\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"../default.aspx\"><img src=\"../images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"../default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"../feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"../images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"../images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"../default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"../default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"../default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"../default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"../default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"../default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"../default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"../default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"../default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"../default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"../default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"../default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"../default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"../default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"../default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"../default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"../default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"../default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"../default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"../default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"../cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"../default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"../default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"../default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n\
+      \r\n\
+      <div class=\"fl\" style=\"width: 99%;\">\r\n\
+      \r\n\
+      <h1>Online Banking Login</h1>\r\n\
+      \r\n\
+      <!-- To get the latest admin login, please contact SiteOps at 415-555-6159 -->\r\n\
+      <p><span id=\"_ctl0__ctl0_Content_Main_message\"><b><font color=\"#FF0066\" size=\"3\"></font></b></span></p>\r\n\
+      \r\n\
+      <form action=\"login.aspx\" method=\"post\" name=\"login\" id=\"login\" onsubmit=\"return (confirminput(login));\">\r\n  <table>\r\n    <tr>\r\n      <td>\r\n        Username:\r\n      </td>\r\n      <td>\r\n        <input type=\"text\" id=\"uid\" name=\"uid\" value=\"\" style=\"width: 150px;\">\r\n      </td>\r\n      <td>\r\n      </td>\r\n    </tr>\r\n    <tr>\r\n      <td>\r\n        Password:\r\n      </td>\r\n      <td>\r\n        <input type=\"password\" id=\"passw\" name=\"passw\" style=\"width: 150px;\">\r\n        </td>\r\n    </tr>\r\n    <tr>\r\n        <td></td>\r\n        <td>\r\n          <input type=\"submit\" name=\"btnSubmit\" value=\"Login\">\r\n        </td>\r\n      </tr>\r\n  </table>\r\n\
+      </form>\r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <script>\r\n\
+      function setfocus() {\r\n    if (document.login.uid.value==\"\") {\r\n      document.login.uid.focus();\r\n    } else {\r\n      document.login.passw.focus();\r\n    }\r\n\
+      }\r\n\
+      \r\n\
+      function confirminput(myform) {\r\n    if (myform.uid.value.length && myform.passw.value.length) {\r\n      return (true);\r\n    } else if (!(myform.uid.value.length)) {\r\n      myform.reset();\r\n      myform.uid.focus();\r\n      alert (\"You must enter a valid username\");\r\n      return (false);\r\n    } else {\r\n      myform.passw.focus();\r\n      alert (\"You must enter a valid password\");\r\n      return (false);\r\n    }\r\n\
+      }\r\n\
+      window.onload = setfocus;\r\n\
+      </script>\r\n\
+      \r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"../default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"../default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Medium
+    tags:
+    - unencrypted
+    - password
+    - form
+    url: http://testfire.net/bank/login.aspx
+    var: passw
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "548"
+  cwe_url: http://cwe.mitre.org/data/definitions/548.html
+  description: |-
+    In most circumstances enabling directory listings is a bad practise
+        as it allows an attacker to better grasp the web application's structure.
+  elem: server
+  internal_modname: DirectoryListing
+  method: GET
+  mod_name: Directory listing
+  name: Directory listing is enabled.
+  references: {}
+
+  severity: Low
+  tags:
+  - path
+  - directory
+  - listing
+  - index
+  url: http://testfire.net/bank/
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "548"
+    cwe_url: http://cwe.mitre.org/data/definitions/548.html
+    description: |-
+      In most circumstances enabling directory listings is a bad practise
+          as it allows an attacker to better grasp the web application's structure.
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 200 OK
+        Content-Length: 2354
+        Content-Type: text/html
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        Date: Sun, 15 Jul 2012 18:22:43 GMT
+
+
+    id:
+    injected:
+    internal_modname: DirectoryListing
+    method: GET
+    mod_name: Directory listing
+    name: Directory listing is enabled.
+    opts:
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Low
+    tags:
+    - path
+    - directory
+    - listing
+    - index
+    url: http://testfire.net/bank/
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie is allowed to be served over
+        an unencrypted channel which makes it susceptible to sniffing.
+  elem: cookie
+  internal_modname: InsecureCookies
+  method: GET
+  mod_name: Insecure cookies
+  name: Insecure cookie
+  references:
+    SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+  remedy_guidance: Set the 'Secure' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: cookiename
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie is allowed to be served over
+          an unencrypted channel which makes it susceptible to sniffing.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: InsecureCookies
+    method: GET
+    mod_name: Insecure cookies
+    name: Insecure cookie
+    opts:
+      :var: cookiename
+      :element: cookie
+      :regexp: ""
+    references:
+      SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'Secure' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: cookiename
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie is allowed to be served over
+        an unencrypted channel which makes it susceptible to sniffing.
+  elem: cookie
+  internal_modname: InsecureCookies
+  method: GET
+  mod_name: Insecure cookies
+  name: Insecure cookie
+  references:
+    SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+  remedy_guidance: Set the 'Secure' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: cookiename2
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie is allowed to be served over
+          an unencrypted channel which makes it susceptible to sniffing.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: InsecureCookies
+    method: GET
+    mod_name: Insecure cookies
+    name: Insecure cookie
+    opts:
+      :var: cookiename2
+      :element: cookie
+      :regexp: ""
+    references:
+      SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'Secure' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: cookiename2
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie is allowed to be served over
+        an unencrypted channel which makes it susceptible to sniffing.
+  elem: cookie
+  internal_modname: InsecureCookies
+  method: GET
+  mod_name: Insecure cookies
+  name: Insecure cookie
+  references:
+    SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+  remedy_guidance: Set the 'Secure' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: ASP.NET_SessionId
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie is allowed to be served over
+          an unencrypted channel which makes it susceptible to sniffing.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: InsecureCookies
+    method: GET
+    mod_name: Insecure cookies
+    name: Insecure cookie
+    opts:
+      :var: ASP.NET_SessionId
+      :element: cookie
+      :regexp: ""
+    references:
+      SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'Secure' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: ASP.NET_SessionId
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie is allowed to be served over
+        an unencrypted channel which makes it susceptible to sniffing.
+  elem: cookie
+  internal_modname: InsecureCookies
+  method: GET
+  mod_name: Insecure cookies
+  name: Insecure cookie
+  references:
+    SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+  remedy_guidance: Set the 'Secure' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: amSessionId
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie is allowed to be served over
+          an unencrypted channel which makes it susceptible to sniffing.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: InsecureCookies
+    method: GET
+    mod_name: Insecure cookies
+    name: Insecure cookie
+    opts:
+      :var: amSessionId
+      :element: cookie
+      :regexp: ""
+    references:
+      SecureFlag - OWASP: https://www.owasp.org/index.php/SecureFlag
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'Secure' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: amSessionId
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie does not have the HttpOnly
+        flag set which makes it succeptible to maniplation via client-side code.
+  elem: cookie
+  internal_modname: HttpOnlyCookies
+  method: GET
+  mod_name: HttpOnly cookies
+  name: HttpOnly cookie
+  references:
+    HttpOnly - OWASP: https://www.owasp.org/index.php/HttpOnly
+  remedy_guidance: Set the 'HttpOnly' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: cookiename
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie does not have the HttpOnly
+          flag set which makes it succeptible to maniplation via client-side code.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: HttpOnlyCookies
+    method: GET
+    mod_name: HttpOnly cookies
+    name: HttpOnly cookie
+    opts:
+      :var: cookiename
+      :element: cookie
+      :regexp: ""
+    references:
+      HttpOnly - OWASP: https://www.owasp.org/index.php/HttpOnly
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'HttpOnly' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: cookiename
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie does not have the HttpOnly
+        flag set which makes it succeptible to maniplation via client-side code.
+  elem: cookie
+  internal_modname: HttpOnlyCookies
+  method: GET
+  mod_name: HttpOnly cookies
+  name: HttpOnly cookie
+  references:
+    HttpOnly - OWASP: https://www.owasp.org/index.php/HttpOnly
+  remedy_guidance: Set the 'HttpOnly' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: cookiename2
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie does not have the HttpOnly
+          flag set which makes it succeptible to maniplation via client-side code.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: HttpOnlyCookies
+    method: GET
+    mod_name: HttpOnly cookies
+    name: HttpOnly cookie
+    opts:
+      :var: cookiename2
+      :element: cookie
+      :regexp: ""
+    references:
+      HttpOnly - OWASP: https://www.owasp.org/index.php/HttpOnly
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'HttpOnly' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: cookiename2
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: |-
+    The logged cookie does not have the HttpOnly
+        flag set which makes it succeptible to maniplation via client-side code.
+  elem: cookie
+  internal_modname: HttpOnlyCookies
+  method: GET
+  mod_name: HttpOnly cookies
+  name: HttpOnly cookie
+  references:
+    HttpOnly - OWASP: https://www.owasp.org/index.php/HttpOnly
+  remedy_guidance: Set the 'HttpOnly' flag in the cookie.
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/
+  var: amSessionId
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: |-
+      The logged cookie does not have the HttpOnly
+          flag set which makes it succeptible to maniplation via client-side code.
+    elem: cookie
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:18:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "9590"
+    id:
+    injected:
+    internal_modname: HttpOnlyCookies
+    method: GET
+    mod_name: HttpOnly cookies
+    name: HttpOnly cookie
+    opts:
+      :var: amSessionId
+      :element: cookie
+      :regexp: ""
+    references:
+      HttpOnly - OWASP: https://www.owasp.org/index.php/HttpOnly
+    regexp: ""
+    regexp_match:
+    remedy_guidance: Set the 'HttpOnly' flag in the cookie.
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"subheader\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <br />\n\
+      <table border=0 cellspacing=0 width=\"100%\">\n  <tr>\n    <td width=\"33%\" valign=\"top\">\n        <b><a href=\"default.aspx?content=personal_savings.htm\">Online Banking with FREE Online Bill Pay </a></b><br />\n        No stamps, envelopes, or checks to write give you more time to spend on the things you enjoy. <br />\n        <br />\n        <center><img src=\"images/home1.jpg\" width=\"170\" height=\"114\" /></center>\n        <br />\n\n        <b><a href=\"default.aspx?content=personal_loans.htm\">Real Estate Financing</a></b><br />\n        Fast. Simple. Professional. Whether you are preparing to buy, build, purchase land, or construct new space, let Altoro Mutual's premier real estate lenders help with financing. As a regional leader, we know the market, we understand the business, and we have the track record to prove it\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <center><img src=\"images/home2.jpg\" width=\"170\" height=\"128\" /></center>\n        <br /><br/>\n        <b><a href=\"default.aspx?content=business_cards.htm\">Business Credit Cards</a></b><br />\n        You're always looking for ways to improve your company's bottom line. You want to be informed, improve efficiency and control expenses. Now, you can do it all - with a business credit card account from Altoro Mutual.\n        <br />\n\n        <br />\n        <b><a href=\"default.aspx?content=business_retirement.htm\">Retirement Solutions</a></b><br />\n        Retaining good employees is a tough task. See how Altoro Mutual can assist you in accomplishing this feat through effective Retirement Solutions.\n    </td>\n    <td width=\"33%\" valign=\"top\">\n        <b>Privacy and Security </b><br />\n        The 2000 employees of Altoro Mutual are dedicated to protecting your <a href=\"default.aspx?content=privacy.htm\">privacy</a> and <a href=\"default.aspx?content=security.htm\">security</a>. We pledge to provide you with the information and resources that you need to help secure your information and keep it confidential.  This is our promise.\n        <br /><br />\n\n        <center><img src=\"images/home3.jpg\" width=\"170\" height=\"113\" /></center><br /><br />\n\n        <b><a href=\"survey_questions.aspx\">Win an 8GB iPod Nano</a></b>\n        <br />\n        Completing this short survey will enter you in a draw for 1 of 50 iPod Nanos.  We look forward to hearing your important feedback.\n        <br /><br />\n\n    </td>\n  </tr>\n\
+      </table>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/
+    var: amSessionId
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/default.aspx
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 500 Internal Server Error
+        Connection: close
+        Date: Sun, 15 Jul 2012 18:18:56 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: -1
+        Content-Type: text/html; charset=utf-8
+
+
+    id: "Code: 500"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 500"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/default.aspx
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        ): 9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 400 Bad Request
+        Content-Type: text/html
+        Date: Sun, 15 Jul 2012 18:19:28 GMT
+        Connection: close
+        Content-Length: 42
+
+
+    id: "Code: 400"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 400"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: The webserver claims that it supports the logged methods.
+  elem: server
+  internal_modname: AllowedMethods
+  method: OPTIONS
+  mod_name: AllowedMethods
+  name: Allowed HTTP methods
+  references: {}
+
+  severity: Informational
+  tags:
+  - http
+  - methods
+  - options
+  url: http://testfire.net/
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: The webserver claims that it supports the logged methods.
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 200 OK
+        Allow: OPTIONS, TRACE, GET, HEAD
+        Content-Length: 0
+        Server: Microsoft-IIS/6.0
+        Public: OPTIONS, TRACE, GET, HEAD, POST
+        X-Powered-By: ASP.NET
+        Date: Sun, 15 Jul 2012 18:19:31 GMT
+
+
+    id:
+    injected:
+    internal_modname: AllowedMethods
+    method: OPTIONS
+    mod_name: AllowedMethods
+    name: Allowed HTTP methods
+    opts:
+      :element: server
+      :match: OPTIONS, TRACE, GET, HEAD
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match: OPTIONS, TRACE, GET, HEAD
+    response:
+    severity: Informational
+    tags:
+    - http
+    - methods
+    - options
+    url: http://testfire.net/
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/admin/
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 403 Forbidden
+        Content-Length: 218
+        Content-Type: text/html
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        Date: Sun, 15 Jul 2012 18:19:34 GMT
+
+
+    id: "Code: 403"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 403"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/admin/
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/search.aspx.cs
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 302 Found
+        Date: Sun, 15 Jul 2012 18:19:45 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Location: /servererror.aspx?aspxerrorpath=/search.aspx.cs
+        Cache-Control: private
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 172
+
+
+    id: "Code: 302"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 302"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/search.aspx.cs
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/Copy%20of%20search.aspx
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 302 Found
+        Date: Sun, 15 Jul 2012 18:19:45 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Location: /notfound.aspx?aspxerrorpath=/Copy%20of%20search.aspx
+        Cache-Control: private
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 182
+
+
+    id: "Code: 302"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 302"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/Copy%20of%20search.aspx
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  cwe: "200"
+  cwe_url: http://cwe.mitre.org/data/definitions/200.html
+  description: Greps pages for HTML objects.
+  elem: body
+  internal_modname: HTMLObjects
+  method: GET
+  mod_name: HTML objects
+  name: Found an HTML object.
+  references: {}
+
+  severity: Informational
+  tags: []
+
+  url: http://testfire.net/default.aspx
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: Greps pages for HTML objects.
+    elem: body
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:19:25 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "10452"
+    id:
+    injected:
+    internal_modname: HTMLObjects
+    method: GET
+    mod_name: HTML objects
+    name: Found an HTML object.
+    opts:
+      :regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+      :match: " classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" /"
+      :element: body
+    references: {}
+
+    regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+    regexp_match: " classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" /"
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <div class=\"fl\" style=\"width: 67%;\">\n\n\
+      <h1>Contact Us</h1>\n\n\
+      <p>Have a question? It's easy to reach us.</p>\n\n\
+      <h2>E-mail</h2>\n\
+      <p>Filling out the <a href=\"feedback.aspx\">online form</a> is the most efficient method of contact.\n\
+      If you are requesting a change to your account, please call the phone number listed below.</p>\n\n\
+      <h2>Phone</h2>\n\
+      <p>To open a new account, please call:<br />\n\
+      1.888.245.5550<br />\n\
+      8:00 a.m. - 6:00 p.m., Eastern Time, Monday - Friday</p>\n\n\
+      <p>For assistance with your account, please call:<br />\n\
+      1.613.599.3888<br />\n\
+      24-hour touch-tone banking information is available 7 days a week.</p>\n\n\
+      <h2>Mail</h2>\n\
+      <p>To contact us by mail, you may send inquiries to:<br />\n\
+      Altoro Mutual<br />\n\
+      Altoro Mutual Tower<br />\n\
+      Anywhere, MA </p>\n\n\n\
+      <h2>E-mail Security</h2>\n\
+      <p>Any inquiry you send to Altoro Mutual via our Contact Us page uses Secure Socket Layer (SSL) encryption. SSL helps to ensure that your personal information remains confidential.</p>\n\n\
+      <p>To take advantage of SSL, however, you must have an SSL-compatible browser. Altoro Mutual recommends you use the following browsers:</p>\n\
+      <ul>\n    <li><b>Windows and Unix operating systems:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.01 or later.</li>\n    <li><b>Macintosh:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.5 or later.</li>\n\
+      </ul>\n\
+      <p>Go to <a title=\"Netscape\" onclick=\"window.open('disclaimer.htm?url=http://www.netscape.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.netscape.com\" target=\"_blank\">Netscape</a> or <a title=\"Microsoft\" onclick=\"window.open('disclaimer.htm?url=http://www.microsoft.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.microsoft.com\" target=\"_blank\">Microsoft</a> for downloads.</p>\n\n\n\
+      <h2>Mail Subscription</h2>\n\
+      <p>Altoro Mutual often introduces new and exciting promotions.  We encourage all visitors to subscribe to our mailing list to receive these incredible offers.<br />\n  <div class=\"cc\" style=\"text-align:center;border:#5811B0 1px solid;\">\n      <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" />\n      </object>\n  </div>\n\
+      </p>\n\n\
+      <br /><br />\n\n\
+      </div>\n\n\
+      <div class=\"flp\" style=\"width: 150px;\">\n\n\
+      <img src=\"images/inside6.jpg\" alt=\"Contact Altoro For all your needs\"><br />\n\n\
+      <span class=\"credit\">\n\
+      Altoro Mutual is headquartered at the Altoro Mutual Tower in Anywhere, MA.\n\
+      </span>\n\n\
+      </div>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/default.aspx
+    var:
+    variations: []
+
+    verification: false
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: Greps pages for HTML objects.
+    elem: body
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:19:25 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "10452"
+    id:
+    injected:
+    method: GET
+    mod_name: HTML objects
+    name: Found an HTML object.
+    opts:
+      :regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+      :match: "\n      "
+      :element: body
+    references: {}
+
+    regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+    regexp_match: "\n      "
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <div class=\"fl\" style=\"width: 67%;\">\n\n\
+      <h1>Contact Us</h1>\n\n\
+      <p>Have a question? It's easy to reach us.</p>\n\n\
+      <h2>E-mail</h2>\n\
+      <p>Filling out the <a href=\"feedback.aspx\">online form</a> is the most efficient method of contact.\n\
+      If you are requesting a change to your account, please call the phone number listed below.</p>\n\n\
+      <h2>Phone</h2>\n\
+      <p>To open a new account, please call:<br />\n\
+      1.888.245.5550<br />\n\
+      8:00 a.m. - 6:00 p.m., Eastern Time, Monday - Friday</p>\n\n\
+      <p>For assistance with your account, please call:<br />\n\
+      1.613.599.3888<br />\n\
+      24-hour touch-tone banking information is available 7 days a week.</p>\n\n\
+      <h2>Mail</h2>\n\
+      <p>To contact us by mail, you may send inquiries to:<br />\n\
+      Altoro Mutual<br />\n\
+      Altoro Mutual Tower<br />\n\
+      Anywhere, MA </p>\n\n\n\
+      <h2>E-mail Security</h2>\n\
+      <p>Any inquiry you send to Altoro Mutual via our Contact Us page uses Secure Socket Layer (SSL) encryption. SSL helps to ensure that your personal information remains confidential.</p>\n\n\
+      <p>To take advantage of SSL, however, you must have an SSL-compatible browser. Altoro Mutual recommends you use the following browsers:</p>\n\
+      <ul>\n    <li><b>Windows and Unix operating systems:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.01 or later.</li>\n    <li><b>Macintosh:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.5 or later.</li>\n\
+      </ul>\n\
+      <p>Go to <a title=\"Netscape\" onclick=\"window.open('disclaimer.htm?url=http://www.netscape.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.netscape.com\" target=\"_blank\">Netscape</a> or <a title=\"Microsoft\" onclick=\"window.open('disclaimer.htm?url=http://www.microsoft.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.microsoft.com\" target=\"_blank\">Microsoft</a> for downloads.</p>\n\n\n\
+      <h2>Mail Subscription</h2>\n\
+      <p>Altoro Mutual often introduces new and exciting promotions.  We encourage all visitors to subscribe to our mailing list to receive these incredible offers.<br />\n  <div class=\"cc\" style=\"text-align:center;border:#5811B0 1px solid;\">\n      <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" />\n      </object>\n  </div>\n\
+      </p>\n\n\
+      <br /><br />\n\n\
+      </div>\n\n\
+      <div class=\"flp\" style=\"width: 150px;\">\n\n\
+      <img src=\"images/inside6.jpg\" alt=\"Contact Altoro For all your needs\"><br />\n\n\
+      <span class=\"credit\">\n\
+      Altoro Mutual is headquartered at the Altoro Mutual Tower in Anywhere, MA.\n\
+      </span>\n\n\
+      </div>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/default.aspx
+    var:
+    verification: false
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: Greps pages for HTML objects.
+    elem: body
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:23:24 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "10452"
+    id:
+    injected:
+    method: GET
+    mod_name: HTML objects
+    name: Found an HTML object.
+    opts:
+      :regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+      :match: " classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" /"
+      :element: body
+    references: {}
+
+    regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+    regexp_match: " classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" /"
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <div class=\"fl\" style=\"width: 67%;\">\n\n\
+      <h1>Contact Us</h1>\n\n\
+      <p>Have a question? It's easy to reach us.</p>\n\n\
+      <h2>E-mail</h2>\n\
+      <p>Filling out the <a href=\"feedback.aspx\">online form</a> is the most efficient method of contact.\n\
+      If you are requesting a change to your account, please call the phone number listed below.</p>\n\n\
+      <h2>Phone</h2>\n\
+      <p>To open a new account, please call:<br />\n\
+      1.888.245.5550<br />\n\
+      8:00 a.m. - 6:00 p.m., Eastern Time, Monday - Friday</p>\n\n\
+      <p>For assistance with your account, please call:<br />\n\
+      1.613.599.3888<br />\n\
+      24-hour touch-tone banking information is available 7 days a week.</p>\n\n\
+      <h2>Mail</h2>\n\
+      <p>To contact us by mail, you may send inquiries to:<br />\n\
+      Altoro Mutual<br />\n\
+      Altoro Mutual Tower<br />\n\
+      Anywhere, MA </p>\n\n\n\
+      <h2>E-mail Security</h2>\n\
+      <p>Any inquiry you send to Altoro Mutual via our Contact Us page uses Secure Socket Layer (SSL) encryption. SSL helps to ensure that your personal information remains confidential.</p>\n\n\
+      <p>To take advantage of SSL, however, you must have an SSL-compatible browser. Altoro Mutual recommends you use the following browsers:</p>\n\
+      <ul>\n    <li><b>Windows and Unix operating systems:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.01 or later.</li>\n    <li><b>Macintosh:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.5 or later.</li>\n\
+      </ul>\n\
+      <p>Go to <a title=\"Netscape\" onclick=\"window.open('disclaimer.htm?url=http://www.netscape.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.netscape.com\" target=\"_blank\">Netscape</a> or <a title=\"Microsoft\" onclick=\"window.open('disclaimer.htm?url=http://www.microsoft.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.microsoft.com\" target=\"_blank\">Microsoft</a> for downloads.</p>\n\n\n\
+      <h2>Mail Subscription</h2>\n\
+      <p>Altoro Mutual often introduces new and exciting promotions.  We encourage all visitors to subscribe to our mailing list to receive these incredible offers.<br />\n  <div class=\"cc\" style=\"text-align:center;border:#5811B0 1px solid;\">\n      <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" />\n      </object>\n  </div>\n\
+      </p>\n\n\
+      <br /><br />\n\n\
+      </div>\n\n\
+      <div class=\"flp\" style=\"width: 150px;\">\n\n\
+      <img src=\"images/inside6.jpg\" alt=\"Contact Altoro For all your needs\"><br />\n\n\
+      <span class=\"credit\">\n\
+      Altoro Mutual is headquartered at the Altoro Mutual Tower in Anywhere, MA.\n\
+      </span>\n\n\
+      </div>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/default.aspx
+    var:
+    verification: false
+  - !ruby/object:Arachni::Issue
+    cwe: "200"
+    cwe_url: http://cwe.mitre.org/data/definitions/200.html
+    description: Greps pages for HTML objects.
+    elem: body
+    headers:
+      request: {}
+
+      response:
+        Date: Sun, 15 Jul 2012 18:23:24 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-Aspnet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: "-1"
+        Content-Type: text/html; charset=utf-8
+        Content-Length: "10452"
+    id:
+    injected:
+    method: GET
+    mod_name: HTML objects
+    name: Found an HTML object.
+    opts:
+      :regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+      :match: "\n      "
+      :element: body
+    references: {}
+
+    regexp: (?mi-x:<object(.*)>(.*)<\/object>)
+    regexp_match: "\n      "
+    response: "\r\n\
+      \r\n\
+      <!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n\
+      \r\n\
+      <html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" >\r\n\
+      <head id=\"_ctl0__ctl0_head\"><title>\r\n\
+      \tAltoro Mutual\r\n\
+      </title><meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\"><link href=\"style.css\" rel=\"stylesheet\" type=\"text/css\" /><meta name=\"description\" content=\"Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small and middle-market businesses and individuals.\"></head>\r\n\
+      <body style=\"margin-top:5px;\">\r\n\
+      \r\n\
+      <div id=\"header\" style=\"margin-bottom:5px; width: 99%;\">\r\n  <form id=\"frmSearch\" method=\"get\" action=\"/search.aspx\">\r\n\
+      \t  <table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\r\n\
+      \t\t  <tr>\r\n\
+      \t\t      <td rowspan=\"2\"><a id=\"_ctl0__ctl0_HyperLink1\" href=\"default.aspx\"><img src=\"images/logo.gif\" border=\"0\" /></a></td>\r\n\
+      \t\t\t  <td align=\"right\" valign=\"top\">\r\n  \t\t\t  <a id=\"_ctl0__ctl0_LoginLink\" title=\"It does not appear that you have properly authenticated yourself.  Please click here to sign in.\" href=\"bank/login.aspx\"><b><font color=\"Red\">Sign In</font></b></a> | <a id=\"_ctl0__ctl0_HyperLink3\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a> | <a id=\"_ctl0__ctl0_HyperLink4\" href=\"feedback.aspx\">Feedback</a> | <label for=\"txtSearch\">Search</label>\r\n          <input type=\"text\" name=\"txtSearch\" id=\"txtSearch\" accesskey=\"S\" />\r\n          <input type=\"submit\" value=\"Go\" />\r\n\
+      \t\t\t  </td>\r\n\
+      \t\t  </tr>\r\n\
+      \t\t  <tr>\r\n\
+      \t\t\t  <td align=\"right\" style=\"background-image:url(/images/gradient.jpg);padding:0px;margin:0px;\"><img id=\"_ctl0__ctl0_Image1\" src=\"images/header_pic.jpg\" border=\"0\" height=\"60\" width=\"354\" /></td>\r\n\
+      \t\t  </tr>\r\n\
+      \t  </table>\r\n\
+      \t</form>\r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"wrapper\" style=\"width: 99%;\">\r\n    \r\n\
+      \r\n\
+      <table cellspacing=\"0\" width=\"100%\">\r\n  <tr>\r\n    <td width=\"25%\" class=\"bt br bb\"><div id=\"Header1\"><img id=\"_ctl0__ctl0_Content_Image1\" src=\"images/pf_lock.gif\" alt=\"Secure Login\" align=\"absbottom\" border=\"0\" height=\"14\" width=\"12\" /> &nbsp; <a id=\"_ctl0__ctl0_Content_AccountLink\" title=\"You do not appear to have authenticated yourself with the application.  Click here to enter your valid username and password.\" class=\"focus\" href=\"bank/login.aspx\">ONLINE BANKING LOGIN</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header2\"><a id=\"_ctl0__ctl0_Content_LinkHeader2\" class=\"focus\" href=\"default.aspx?content=personal.htm\">PERSONAL</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt br bb\"><div id=\"Header3\"><a id=\"_ctl0__ctl0_Content_LinkHeader3\" class=\"focus\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a></div></td>\r\n    <td width=\"25%\" class=\"cc bt bb\"><div id=\"Header4\"><a id=\"_ctl0__ctl0_Content_LinkHeader4\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a></div></td>\r\n  </tr>\r\n  <tr>\r\n    <td valign=\"top\" class=\"cc br bb\">\r\n        <br style=\"line-height: 10px;\"/>\r\n        <a id=\"_ctl0__ctl0_Content_CatLink1\" class=\"subheader\" href=\"default.aspx?content=personal.htm\">PERSONAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink1\" href=\"default.aspx?content=personal_deposit.htm\">Deposit Product</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink2\" href=\"default.aspx?content=personal_checking.htm\">Checking</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink3\" href=\"default.aspx?content=personal_loans.htm\">Loan Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink4\" href=\"default.aspx?content=personal_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink5\" href=\"default.aspx?content=personal_investments.htm\">Investments &amp; Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink6\" href=\"default.aspx?content=personal_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink2\" class=\"subheader\" href=\"default.aspx?content=business.htm\">SMALL BUSINESS</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink7\" href=\"default.aspx?content=business_deposit.htm\">Deposit Products</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink8\" href=\"default.aspx?content=business_lending.htm\">Lending Services</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink9\" href=\"default.aspx?content=business_cards.htm\">Cards</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink10\" href=\"default.aspx?content=business_insurance.htm\">Insurance</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink11\" href=\"default.aspx?content=business_retirement.htm\">Retirement</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink12\" href=\"default.aspx?content=business_other.htm\">Other Services</a></li>\r\n        </ul>\r\n\
+      \r\n        <a id=\"_ctl0__ctl0_Content_CatLink3\" class=\"focus\" href=\"default.aspx?content=inside.htm\">INSIDE ALTORO MUTUAL</a>\r\n        <ul class=\"sidebar\">\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink13\" href=\"default.aspx?content=inside_about.htm\">About Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink14\" href=\"default.aspx?content=inside_contact.htm\">Contact Us</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink15\" href=\"cgi.exe\">Locations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink16\" href=\"default.aspx?content=inside_investor.htm\">Investor Relations</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink17\" href=\"default.aspx?content=inside_press.htm\">Press Room</a></li>\r\n            <li><a id=\"_ctl0__ctl0_Content_MenuHyperLink18\" href=\"default.aspx?content=inside_careers.htm\">Careers</a></li>\r\n        </ul>\r\n    </td>\r\n    <td valign=\"top\" colspan=\"3\" class=\"bb\">\r\n\
+      \r\n    <span id=\"_ctl0__ctl0_Content_Main_lblContent\">\n\
+      <div class=\"fl\" style=\"width: 67%;\">\n\n\
+      <h1>Contact Us</h1>\n\n\
+      <p>Have a question? It's easy to reach us.</p>\n\n\
+      <h2>E-mail</h2>\n\
+      <p>Filling out the <a href=\"feedback.aspx\">online form</a> is the most efficient method of contact.\n\
+      If you are requesting a change to your account, please call the phone number listed below.</p>\n\n\
+      <h2>Phone</h2>\n\
+      <p>To open a new account, please call:<br />\n\
+      1.888.245.5550<br />\n\
+      8:00 a.m. - 6:00 p.m., Eastern Time, Monday - Friday</p>\n\n\
+      <p>For assistance with your account, please call:<br />\n\
+      1.613.599.3888<br />\n\
+      24-hour touch-tone banking information is available 7 days a week.</p>\n\n\
+      <h2>Mail</h2>\n\
+      <p>To contact us by mail, you may send inquiries to:<br />\n\
+      Altoro Mutual<br />\n\
+      Altoro Mutual Tower<br />\n\
+      Anywhere, MA </p>\n\n\n\
+      <h2>E-mail Security</h2>\n\
+      <p>Any inquiry you send to Altoro Mutual via our Contact Us page uses Secure Socket Layer (SSL) encryption. SSL helps to ensure that your personal information remains confidential.</p>\n\n\
+      <p>To take advantage of SSL, however, you must have an SSL-compatible browser. Altoro Mutual recommends you use the following browsers:</p>\n\
+      <ul>\n    <li><b>Windows and Unix operating systems:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.01 or later.</li>\n    <li><b>Macintosh:</b> Netscape Navigator 4.08 or later, Netscape Communicator 4.7 or later, and Microsoft Internet Explorer 4.5 or later.</li>\n\
+      </ul>\n\
+      <p>Go to <a title=\"Netscape\" onclick=\"window.open('disclaimer.htm?url=http://www.netscape.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.netscape.com\" target=\"_blank\">Netscape</a> or <a title=\"Microsoft\" onclick=\"window.open('disclaimer.htm?url=http://www.microsoft.com', '_blank', 'status=no,location=no,menubar=no,resizable=no,scrollbars=no,toolbar=no,width=450,height=200'); return false;\" href=\"disclaimer.htm?url=http://www.microsoft.com\" target=\"_blank\">Microsoft</a> for downloads.</p>\n\n\n\
+      <h2>Mail Subscription</h2>\n\
+      <p>Altoro Mutual often introduces new and exciting promotions.  We encourage all visitors to subscribe to our mailing list to receive these incredible offers.<br />\n  <div class=\"cc\" style=\"text-align:center;border:#5811B0 1px solid;\">\n      <object classid=\"clsid:d27cdb6e-ae6d-11cf-96b8-444553540000\" codebase=\"http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0\" width=\"125\" height=\"50\" id=\"subscribe\" align=\"middle\">\n        <param name=\"allowScriptAccess\" value=\"sameDomain\" />\n\n        <param name=\"movie\" value=\"subscribe.swf\" />\n        <param name=\"quality\" value=\"high\" />\n        <param name=\"bgcolor\" value=\"#ffffff\" />\n        <embed src=\"subscribe.swf\" quality=\"high\" bgcolor=\"#ffffff\" width=\"125\" height=\"50\" name=\"subscribe\" align=\"middle\" allowScriptAccess=\"sameDomain\" type=\"application/x-shockwave-flash\" pluginspage=\"http://www.macromedia.com/go/getflashplayer\" />\n      </object>\n  </div>\n\
+      </p>\n\n\
+      <br /><br />\n\n\
+      </div>\n\n\
+      <div class=\"flp\" style=\"width: 150px;\">\n\n\
+      <img src=\"images/inside6.jpg\" alt=\"Contact Altoro For all your needs\"><br />\n\n\
+      <span class=\"credit\">\n\
+      Altoro Mutual is headquartered at the Altoro Mutual Tower in Anywhere, MA.\n\
+      </span>\n\n\
+      </div>\n\
+      </span>\r\n\
+      \r\n    </td>\r\n  </tr>\r\n\
+      </table>\r\n\
+      \r\n\
+      \r\n\
+      </div>\r\n\
+      \r\n\
+      <div id=\"footer\" style=\"width: 99%;\">\r\n    <a id=\"_ctl0__ctl0_HyperLink5\" href=\"default.aspx?content=privacy.htm\">Privacy Policy</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    <a id=\"_ctl0__ctl0_HyperLink6\" href=\"default.aspx?content=security.htm\">Security Statement</a>\r\n    &nbsp;&nbsp;|&nbsp;&nbsp;\r\n    &copy; 2012 Altoro Mutual, Inc.\r\n\
+      \r\n    <div class=\"disclaimer\">\r\n        The Altoro Mutual website is published by Watchfire, Inc. for the sole purpose of\r\n        demonstrating the effectiveness of Watchfire products in detecting web application\r\n        vulnerabilities and website defects. This site is not a real banking site. Similarities,\r\n        if any, to third party products and/or websites are purely coincidental. This site is\r\n        provided \"as is\" without warranty of any kind, either express or implied. Watchfire does\r\n        not assume any risk in relation to your use of this website. For additional Terms of Use,\r\n        please go to <a id=\"_ctl0__ctl0_HyperLink7\" href=\"http://www.watchfire.com/statements/terms.aspx\">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />\r\n\
+      \r\n        Copyright &copy; 2012, Watchfire Corporation, All rights reserved.\r\n    </div>\r\n\
+      </div>\r\n\
+      \r\n\
+      </body>\r\n\
+      </html>"
+    severity: Informational
+    tags: []
+
+    url: http://testfire.net/default.aspx
+    var:
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: POST
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/bank/login.aspx
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 500 Internal Server Error
+        Connection: close
+        Date: Sun, 15 Jul 2012 18:21:40 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Cache-Control: no-cache
+        Pragma: no-cache
+        Expires: -1
+        Content-Type: text/html; charset=utf-8
+
+
+    id: "Code: 500"
+    injected:
+    internal_modname: InterestingResponses
+    method: POST
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 500"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/bank/login.aspx
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/bank/members/
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 401 Unauthorized
+        Content-Length: 1656
+        Content-Type: text/html
+        Server: Microsoft-IIS/6.0
+        WWW-Authenticate: Basic realm="testfire.net"
+        X-Powered-By: ASP.NET
+        Date: Sun, 15 Jul 2012 18:22:42 GMT
+
+
+    id: "Code: 401"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 401"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/bank/members/
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/bank/login.aspx.cs
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 302 Found
+        Date: Sun, 15 Jul 2012 18:22:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Location: /servererror.aspx?aspxerrorpath=/bank/login.aspx.cs
+        Cache-Control: private
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 178
+
+
+    id: "Code: 302"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 302"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/bank/login.aspx.cs
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+- !ruby/object:Arachni::Issue
+  description: "The server responded with a non 200 (OK) code. "
+  elem: server
+  internal_modname: InterestingResponses
+  method: GET
+  mod_name: Interesting responses
+  name: Interesting server response.
+  references: {}
+
+  severity: Informational
+  tags:
+  - interesting
+  - response
+  - server
+  url: http://testfire.net/bank/Copy%20of%20login.aspx
+  var:
+  variations:
+  - !ruby/object:Arachni::Issue
+    description: "The server responded with a non 200 (OK) code. "
+    elem: server
+    headers:
+      request:
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        User-Agent: Arachni/v0.4.1dev
+        Cookie: cookiename=cookieval;cookiename2=cookieval2;ASP.NET_SessionId=qz0azzio1wni3b45teryv4as;amSessionId=131836126604
+      response: |
+        HTTP/1.1 302 Found
+        Date: Sun, 15 Jul 2012 18:22:43 GMT
+        Server: Microsoft-IIS/6.0
+        X-Powered-By: ASP.NET
+        X-AspNet-Version: 2.0.50727
+        Location: /notfound.aspx?aspxerrorpath=/bank/Copy%20of%20login.aspx
+        Cache-Control: private
+        Content-Type: text/html; charset=utf-8
+        Content-Length: 188
+
+
+    id: "Code: 302"
+    injected:
+    internal_modname: InterestingResponses
+    method: GET
+    mod_name: Interesting responses
+    name: Interesting server response.
+    opts:
+      :id: "Code: 302"
+      :element: server
+      :regexp: ""
+    references: {}
+
+    regexp: ""
+    regexp_match:
+    response:
+    severity: Informational
+    tags:
+    - interesting
+    - response
+    - server
+    url: http://testfire.net/bank/Copy%20of%20login.aspx
+    var:
+    variations: []
+
+    verification: false
+  verification: false
+options:
+  dir:
+    root: /home/zapotek/workspace/arachni/
+    gfx: /home/zapotek/workspace/arachni/gfx/
+    conf: /home/zapotek/workspace/arachni/conf/
+    logs: /home/zapotek/workspace/arachni/logs/
+    data: /home/zapotek/workspace/arachni/data/
+    modules: /home/zapotek/workspace/arachni/modules/
+    reports: /home/zapotek/workspace/arachni/reports/
+    plugins: /home/zapotek/workspace/arachni/plugins/
+    path_extractors: /home/zapotek/workspace/arachni/path_extractors/
+    lib: /home/zapotek/workspace/arachni/lib/arachni/
+    mixins: /home/zapotek/workspace/arachni/lib/arachni/mixins/
+    arachni: /home/zapotek/workspace/arachni/lib/arachni
+  datastore: {}
+
+  redundant: {}
+
+  obey_robots_txt: false
+  depth_limit: -1
+  link_count_limit: -1
+  redirect_limit: 20
+  lsmod: []
+
+  lsrep: []
+
+  http_req_limit: 20
+  mods:
+  - code_injection
+  - path_traversal
+  - sqli_blind_rdiff
+  - xss_uri
+  - ldapi
+  - rfi
+  - response_splitting
+  - os_cmd_injection
+  - os_cmd_injection_timing
+  - sqli_blind_timing
+  - xpath
+  - csrf
+  - code_injection_timing
+  - xss
+  - trainer
+  - xss_tag
+  - xss_script_tag
+  - sqli
+  - unvalidated_redirect
+  - xss_path
+  - xss_event
+  - xst
+  - htaccess_limit
+  - http_put
+  - webdav
+  - allowed_methods
+  - common_directories
+  - interesting_responses
+  - backdoors
+  - backup_files
+  - directory_listing
+  - common_files
+  - private_ip
+  - insecure_cookies
+  - unencrypted_password_forms
+  - ssn
+  - credit_card
+  - html_objects
+  - mixed_resource
+  - emails
+  - http_only_cookies
+  - captcha
+  - cvs_svn_users
+  reports:
+    stdout: {}
+
+  exclude:
+  - (?-mix:stuff)
+  exclude_cookies:
+  - exclude-this-cookie
+  exclude_vectors:
+  - exclude-this-vector
+  include:
+  - (?-mix:testfire)
+  lsplug: []
+
+  plugins: {}
+
+  rpc_instance_port_range:
+  - 1025
+  - 65535
+  load_profile:
+  restrict_paths: []
+
+  extend_paths: []
+
+  custom_headers: {}
+
+  min_pages_per_instance: 30
+  max_slaves: 10
+  audit_links: true
+  audit_forms: true
+  audit_cookies: true
+  audit_headers: true
+  cookie_string: cookiename=cookieval;cookiename2=cookieval2
+  url: http://testfire.net/
+  user_agent: Arachni/v0.4.1dev
+  start_datetime: 2012-07-15 19:29:17.837221 +03:00
+  cookies:
+    cookiename: cookieval
+    cookiename2: cookieval2
+  delta_time: 316.964806531
+  finish_datetime: 2012-07-15 19:34:34.802027 +03:00
+plugins: {}
+revision: 0.2.6
+sitemap:
+- http://testfire.net/
+- http://testfire.net/search.aspx
+- http://testfire.net/default.aspx?content=inside_about.htm
+- http://testfire.net/default.aspx?content=business_deposit.htm
+- http://testfire.net/bank/login.aspx
+- http://testfire.net/default.aspx
+- http://testfire.net/default.aspx?content=inside_contact.htm
+- http://testfire.net/feedback.aspx
+- http://testfire.net/default.aspx?content=personal.htm
+- http://testfire.net/default.aspx?content=business.htm
+- http://testfire.net/default.aspx?content=inside.htm
+- http://testfire.net/default.aspx?content=personal_deposit.htm
+- http://testfire.net/default.aspx?content=personal_checking.htm
+- http://testfire.net/default.aspx?content=personal_loans.htm
+- http://testfire.net/default.aspx?content=personal_cards.htm
+- http://testfire.net/default.aspx?content=personal_investments.htm
+- http://testfire.net/default.aspx?content=personal_other.htm
+- http://testfire.net/default.aspx?content=business_lending.htm
+- http://testfire.net/default.aspx?content=business_insurance.htm
+- http://testfire.net/default.aspx?content=business_other.htm
+- http://testfire.net/default.aspx?content=inside_investor.htm
+- http://testfire.net/default.aspx?content=inside_press.htm
+- http://testfire.net/default.aspx?content=inside_careers.htm
+- http://testfire.net/default.aspx?content=personal_savings.htm
+- http://testfire.net/default.aspx?content=security.htm
+- http://testfire.net/survey_questions.aspx
+- http://testfire.net/style.css
+- http://testfire.net/default.aspx?content=business_cards.htm
+- http://testfire.net/default.aspx?content=privacy.htm
+- http://testfire.net/cgi.exe
+- http://testfire.net/default.aspx?content=business_retirement.htm
+- http://testfire.net/inside_points_of_interest.htm
+- http://testfire.net/default.aspx?content=inside_community.htm
+- http://testfire.net/high_yield_investments.htm
+- http://testfire.net/disclaimer.htm?url=http://www.netscape.com
+- http://testfire.net/disclaimer.htm?url=http://www.microsoft.com
+- http://testfire.net/comment.aspx
+- http://testfire.net/default.aspx?content=inside_trainee.htm
+- http://testfire.net/survey_questions.aspx?step=a
+- http://testfire.net/retirement.htm
+- http://testfire.net/default.aspx?content=inside_executives.htm
+- http://testfire.net/notfound.aspx?aspxerrorpath=/Privacypolicy.aspx
+- http://testfire.net/pr/communityannualreport.pdf
+- http://testfire.net/default.aspx?content=inside_internships.htm
+- http://testfire.net/admin/clients.xls
+- http://testfire.net/default.aspx?content=pr/20060518.htm
+- http://testfire.net/default.aspx?content=pr/20060413.htm
+- http://testfire.net/default.aspx?content=inside_jobs.htm
+- http://testfire.net/default.aspx?content=pr/20060817.htm
+- http://testfire.net/default.aspx?content=pr/20061005.htm
+- http://testfire.net/default.aspx?content=pr/20060921.htm
+- http://testfire.net/default.aspx?content=pr/20060720.htm
+- http://testfire.net/default.aspx?content=pr/20061109.htm
+- http://testfire.net/default.aspx?content=pr/20060928.htm
+- http://testfire.net/default.aspx?content=inside_benefits.htm
+- http://testfire.net/default.aspx?content=inside_volunteering.htm
+- http://testfire.net/security.htm
+- http://testfire.net/default.aspx?content=inside_jobs.htm&job=ExecutiveAssistant:Administration
+- http://testfire.net/default.aspx?content=inside_jobs.htm&job=CustomerServiceRepresentative:CustomerService
+- http://testfire.net/default.aspx?content=inside_jobs.htm&job=Teller:ConsumaerBanking
+- http://testfire.net/default.aspx?content=inside_jobs.htm&job=LoyaltyMarketingProgramManager:Marketing
+- http://testfire.net/default.aspx?content=inside_jobs.htm&job=MortgageLendingAccountExecutive:Sales
+- http://testfire.net/default.aspx?content=inside_jobs.htm&job=OperationalRiskManager:RiskManagement
+- http://testfire.net/search.aspx?txtSearch=
+- http://testfire.net/default.aspx?_arachni_trainer_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed=9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed&content=inside_contact.htm
+- http://testfire.net/search.aspx?_arachni_trainer_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed=9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed&txtSearch=
+- http://testfire.net/disclaimer.htm?_arachni_trainer_9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed=9c5daba3337198ab5efb2f3b5d245c8d0d8d908088f836cd0509682103e265ed&url=http://www.netscape.com
+start_datetime: Sun Jul 15 19:29:17 2012
+version: 0.4.1dev