Daniel King
Source-scoped identity with 5 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
ExploitDBCisco Adaptive Security Response - HTTP Response Splitting
ExploitDB exploitPublished 2010-06-25Not analyzedCVE-2008-72571 file
ExploitDBMcAfee Network Security Manager < 5.1.11.8.1 - Multiple Cross-Site Scripting Vulnerabilities
ExploitDB exploitPublished 2009-11-12WriteupCVE-2009-35651 file
Analysis
Technical assessment
The artifact is a brief technical writeup describing multiple cross-site scripting (XSS) vulnerabilities in McAfee IntruShield Network Security Manager (NSM) before 5.1.11.6. It explains the attack vector and provides two example malicious URIs that inject JavaScript via the 'iaction' and 'node' parameters in Login.jsp, but contains no executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The artifact is a plaintext description of two cross-site scripting (XSS) proof-of-concept URIs targeting McAfee Network Security Manager. It contains no executable code, no obfuscation, no concealed payloads, and no instructions for the reader to perform any action beyond viewing the example URIs. The content is consistent with a standard public exploit disclosure.
Classification basis and observed behavior
Classification basis
The artifact contains only a textual description of the vulnerability and example URIs; it lacks any executable code, automated detection logic, or exploitation mechanism, making it a writeup rather than an exploit or scanner.
exploits/jsp/webapps/10061.txt:1-7Requirements
- Victim must follow a malicious URI
exploits/jsp/webapps/10061.txt:1
Observed behavior
- Provides example URIs that inject JavaScript via iaction and node parameters
exploits/jsp/webapps/10061.txt:5-7
Behaviors behind the backdoor verdict
Observables
- Xss Payload
- Payload withheldExample XSS payload injected into the 'iaction' parameter of a Login.jsp URI.
exploits/jsp/webapps/10061.txt:5 - Xss Payload
- Payload withheldExample XSS payload injected into the 'node' parameter of a Login.jsp URI.
exploits/jsp/webapps/10061.txt:7
What the analysis did not establish
- Evidence is limited to the single text file; no external tools, libraries, or referenced resources are included.
- The artifact is a static description; no dynamic behavior or execution context is available.
- Only the supplied text file was reviewed; no external resources or linked URIs were fetched or analyzed.
- The review does not assess the validity or effectiveness of the XSS payloads against the target application.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
ExploitDBMcAfee Network Security Manager < 5.1.11.8.1 - Information Disclosure
ExploitDB exploitPublished 2009-11-12ScannerUnlinked1 file
Analysis
Technical assessment
The artifact describes a reflected cross-site scripting (XSS) vulnerability in McAfee Network Security Manager and provides a URL that, when visited by a victim, exfiltrates the victim's cookies to an attacker-controlled server. The URL demonstrates detection/validation of the vulnerability by triggering cookie exfiltration, not by performing an action on the target system beyond information disclosure.
Backdoor review
No backdoor observed in reviewed code
The PoC describes a reflected XSS information disclosure attack against a specific vulnerable application. The supplied text contains only a description and a single URL-encoded example payload. No concealed executable behavior, persistence, unrelated payload, or operator-directed harm is present in the reviewed evidence.
Classification basis and observed behavior
Classification basis
The artifact provides a URL that demonstrates the XSS vulnerability by exfiltrating cookies to an external server. This is a proof-of-concept for detection/validation (scanner) rather than an exploit that performs a malicious action on the target system itself. The description explicitly states it is a 'proof of concept' for information disclosure.
exploits/jsp/webapps/10059.txt:3exploits/jsp/webapps/10059.txt:5-6Requirements
- Victim must be enticed to view a malicious webpage or click a crafted link.
exploits/jsp/webapps/10059.txt:1 - Attacker must control a server (x.x.x.x) to receive exfiltrated cookies.
exploits/jsp/webapps/10059.txt:5-6
Observed behavior
- Crafts a URL that injects a script into the McAfee Network Security Manager login page.
exploits/jsp/webapps/10059.txt:5-6 - The injected script creates an Image object to send the victim's cookies to an attacker-controlled server (x.x.x.x).
exploits/jsp/webapps/10059.txt:5-6
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldThe PoC URL demonstrates a reflected XSS payload that exfiltrates document.cookie to an attacker-controlled server. This is the described information disclosure behavior against the target application.
exploits/jsp/webapps/10059.txt:5-6
What the analysis did not establish
- Only the text file content was analyzed; no external resources or execution were performed.
- The URL contains placeholder IP addresses (x.x.x.x) and a target domain (www.example.com), indicating it is a template rather than a live exploit.
- Only the supplied text file was reviewed; no external resources, linked scripts, or network destinations were fetched or analyzed.
- The URL-encoded payload was decoded for review, but the review does not execute or render the payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.