Null HTTPd is a simple HTTP server that runs on Win32/Unix systems. It is quite basic, but offers good CGI support. A vulnerability in Null HTTPd may allow cross-site scripting via a 404 page: http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT> You have to place this in the query string so that it doesn't get the typical "%xx..." urlencode treatment from the browser. If the code is encoded in any way, it prevents the vulnerability from working. "The reason the mainstream is thought of as a stream is because it is so shallow." - Author Unknown
