The 'view/' site of NetMon is vulnerable to URL-based XSS, allowing an attacker to inject JavaScript code into the website; see CVE-2013-7400. This could be used in a spear phishing campaign to steal session cookies, which would enable compromise of the NetMon host using .
The PoC below gets around this by using the onfocus attribute of an <input> tag in order to get a JavaScript execution environment. From here, the attacker could run arbitrary (possibly encoded) JavaScript code.
https://monitoring.sittingduck.bv/view/%3Cinput%20autofocus%20onfocus%3Dalert(1)%3E
Update NetMon to the latest version, where this issue is fixed.