EIP-2026-118790

This PoC exploits a server name spoofing vulnerability in IIS 5.x and 6.0 by sending a crafted HTTP request with 'localhost' in the Host header, potentially revealing sensitive ASP code via the 500-100.asp error page. The code establishes a socket connection, sends the malicious request, and saves the server response to a file.